security/platform: close audit findings #19–#26

Tests, CSP nonce middleware, SSRF guard, perf-route hardening,
Docker env isolation, migration runbook, RBAC E2E coverage.

Tickets resolved:
- #19: MfaSetup.test.ts — static source tests confirming local QR rendering
- #20: ssrf-guard.test.ts (16 tests) + webhook-procedure-support mock fix
- #21: /api/perf route.test.ts (5 tests) — header-only auth, fail-closed
- #22: middleware.ts (nonce-based CSP) + middleware.test.ts (6 tests);
       layout.tsx async + nonce prop; CSP removed from next.config.ts
- #23: Active-session registry enforcement verified (already in codebase)
- #24: docker-compose.yml REDIS_URL hardcoded (no host-env substitution)
- #25: docker-compose.yml REDIS_URL + docs/developer-runbook.md created
- #26: e2e/dev-system/rbac-data-access.spec.ts (12 tests, 3 roles × 4 procedures)

Quality gates: tsc clean, api 1447/1447, web 189/189 passing.
Turbo concurrency capped at 2 (package.json) to prevent OOM under
parallel test runs.

Co-Authored-By: claude-flow <ruv@ruv.net>

package.json

@@ -8,8 +8,8 @@
     "prebuild": "pnpm check:exports && pnpm check:imports",
     "build": "node ./scripts/run-from-workspace-root.mjs turbo build",
     "lint": "node ./scripts/run-from-workspace-root.mjs turbo lint",
-    "test": "node ./scripts/run-from-workspace-root.mjs turbo run test:unit",
-    "test:unit": "node ./scripts/run-from-workspace-root.mjs turbo test:unit",
+    "test": "node ./scripts/run-from-workspace-root.mjs turbo run test:unit --concurrency=2",
+    "test:unit": "node ./scripts/run-from-workspace-root.mjs turbo test:unit --concurrency=2",
     "test:e2e": "node ./scripts/run-from-workspace-root.mjs turbo test:e2e",
     "test:scripts": "node --test scripts/*.test.mjs",
     "check:architecture": "node ./scripts/check-architecture-guardrails.mjs",