security/platform: close audit findings #19–#26

Tests, CSP nonce middleware, SSRF guard, perf-route hardening,
Docker env isolation, migration runbook, RBAC E2E coverage.

Tickets resolved:
- #19: MfaSetup.test.ts — static source tests confirming local QR rendering
- #20: ssrf-guard.test.ts (16 tests) + webhook-procedure-support mock fix
- #21: /api/perf route.test.ts (5 tests) — header-only auth, fail-closed
- #22: middleware.ts (nonce-based CSP) + middleware.test.ts (6 tests);
       layout.tsx async + nonce prop; CSP removed from next.config.ts
- #23: Active-session registry enforcement verified (already in codebase)
- #24: docker-compose.yml REDIS_URL hardcoded (no host-env substitution)
- #25: docker-compose.yml REDIS_URL + docs/developer-runbook.md created
- #26: e2e/dev-system/rbac-data-access.spec.ts (12 tests, 3 roles × 4 procedures)

Quality gates: tsc clean, api 1447/1447, web 189/189 passing.
Turbo concurrency capped at 2 (package.json) to prevent OOM under
parallel test runs.

Co-Authored-By: claude-flow <ruv@ruv.net>

apps/web/e2e/dev-system/helpers.ts

@@ -16,13 +16,26 @@ export async function signIn(page: Page, email: string, password: string) {
 }
 
 export async function signOut(page: Page) {
-  await page.goto("/auth/signout");
-  // Auth.js v5 renders a confirmation page at /auth/signout before signing out.
-  // Click the submit button if a form is present.
-  const confirmBtn = page.locator('button[type="submit"]').first();
-  if (await confirmBtn.isVisible({ timeout: 3000 }).catch(() => false)) {
-    await confirmBtn.click();
-  }
+  // next-auth/react signOut() POSTs to /auth/signout with a CSRF token.
+  // There is no GET-accessible signout page in this app (/auth/signout returns 404).
+  // Replicate what the client-side signOut() function does:
+  // 1. Fetch the CSRF token from /auth/csrf
+  // 2. POST to /auth/signout with that token
+  // 3. Follow the redirect to /auth/signin
+  await page.goto("/dashboard"); // land on any authenticated page for cookie context
+  await page.evaluate(async () => {
+    const csrfRes = await fetch("/api/auth/csrf");
+    const { csrfToken } = await csrfRes.json() as { csrfToken: string };
+    await fetch("/api/auth/signout", {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ csrfToken, callbackUrl: "/auth/signin", json: "true" }),
+      redirect: "follow",
+    });
+  });
+  // After the POST clears the session cookie, navigating to a protected route
+  // should redirect to sign-in.
+  await page.goto("/dashboard");
   await page.waitForURL(/\/auth\/signin/, { timeout: 10000 });
 }