feat: production readiness hardening

[munisp]

Summary

Integrates the validated production-readiness hardening series, including adverse-action/PII controls, Vault Transit custody and rotation, PostgreSQL RLS isolation, dispatch recovery, verified forensic pagination/cursor rotation, bounded forensic NDJSON export, offline completeness verification, and PWA memory bounds.

Local validation

Fresh disposable PostgreSQL/cross-service validation passed: migrations, compliance/Transit/RLS/dead-letter integrity, forensic keyset EXPLAIN, Node tests, TypeScript, PWA build, Go race tests, archive checks, and mobile type checking.

Notes

No production or staging systems, real external providers, Vault, Permify, object storage, or live PII were accessed. This PR intentionally does not bypass required review or required GitHub checks.

[munisp]

Security maintainer review requested for PR #149

Please review the current PR head, d5de37c, before any merge action. The latest repository-local disposable validation completed 15/15 passing stages, covering PostgreSQL migration and integrity checks, Node tests, TypeScript, PWA build, Go race checks, archival validation, the deprecated-native-client guard, and authoritative bis-mobile typecheck and lint.

The remote node-tests, mobile-security, gateway-race, archive-worker, and all JavaScript/TypeScript, Go, Python, and Rust language-specific CodeQL analyses are currently successful. The aggregate CodeQL comparison remains failing, however, with four open annotations that require security review:

Finding	Location
Server-side request forgery	crates/bis-transport-policy/src/lib.rs:149
Server-side request forgery	crates/bis-transport-policy/src/lib.rs:175
Server-side request forgery	crates/bis-transport-policy/src/lib.rs:187
Uncontrolled allocation size	services/fluvio-velocity/src/main.rs:336-340

The source changes deliberately maintain fail-closed endpoint handling and bounded gateway-payload construction. In particular, TrustedEndpoint requires HTTPS, exact configured host allow-listing, safe URL structure, and safe opaque path segments; dynamic path-derived values remain untrusted. The Fluvio gateway payload now validates variable-width inputs, caps serialized data at 16 KiB, uses a fixed-owner bounded buffer, and has JSON escaping and oversize regression coverage.

The reviewed narrow Rust CodeQL barrier model for the successful TrustedEndpoint::parse boundary remains unpublished and inactive. The package munisp/bis-rust-models@0.1.0 is not present in GHCR. The controlled publication attempt failed with GHCR HTTP 403 because the available credential lacked package-publish authority. A designated package publisher should publish the immutable reviewed pack using a short-lived credential with packages:write, then a security maintainer should activate the model in the Rust-specific CodeQL initialization and re-run the comparison. The model must not classify request-derived dynamic path segments as trusted.

Requested action: Please independently review the current findings and hardening controls, arrange authorized GHCR publication/activation of the narrow model pack, and approve only after the renewed aggregate CodeQL result is acceptable. main protection requires an independent approval; please do not bypass checks, dismiss alerts without validation, or merge unrelated dependency PRs as part of this work.

Detailed evidence is available in PR149_SECURITY_FINDINGS_AND_PATCH_STATUS_20260910.md.