feat: path-aware CI, refreshable export manifest, deployment doctor

[L4XB]

Brings main to the tree develop carries, as one commit on top of main so
both branches stay linear under a squash-only, up-to-date-required policy.

Contents:

• six-community doctor (feat(ops): answer whether a running deployment can do its work #79, closes cli: add a doctor command that proves a deployment's configuration works #45) — reports whether a running
  deployment can do its work: database tables, storage, mail, and which optional
  features are off and why. Off is a decision, not a fault; no secret is printed.
• --refresh-manifest (feat(audit): let whoever changes the tree rewrite its manifest #76) — the export audit can now rewrite the manifest
  a change invalidates, after every other gate has passed.
• Path-aware Companion build (ci: decide the Companion build from the paths a pull request touches #75) — a pull request without Swift changes
  reports both required macOS contexts without starting an Xcode toolchain.
• Dependency update (chore(deps): update the community API dependencies #78) — pypdf, pyarrow, uvicorn, mypy and ruff in one
  uv lock resolution, plus the trivy action bump.
• SECURITY.md credential record (docs(security): record why each credential class is stored the way it is #80, closes security(docs): record the credential-hashing decision in SECURITY.md #44) — why passwords go
  through 600k PBKDF2 iterations while bearer tokens are SHA-256 digests, with a
  test pinning the entropy assumption that reasoning rests on.
• Registration gates (test(auth): cover the two registration gates nothing exercised #82, closes test(auth): prove the public registration path end to end #67) — the signup rate limit and the
  recorded acceptance versions, neither of which had a test.

This runs in parallel with the develop-side pull request carrying the same
content; whichever lands first, both branches end on the same tree.

[L4XB]

I have read and agree to the SixSentences CLA v1.0.