security/platform: close audit findings #19–#26

Tests, CSP nonce middleware, SSRF guard, perf-route hardening,
Docker env isolation, migration runbook, RBAC E2E coverage.

Tickets resolved:
- #19: MfaSetup.test.ts — static source tests confirming local QR rendering
- #20: ssrf-guard.test.ts (16 tests) + webhook-procedure-support mock fix
- #21: /api/perf route.test.ts (5 tests) — header-only auth, fail-closed
- #22: middleware.ts (nonce-based CSP) + middleware.test.ts (6 tests);
       layout.tsx async + nonce prop; CSP removed from next.config.ts
- #23: Active-session registry enforcement verified (already in codebase)
- #24: docker-compose.yml REDIS_URL hardcoded (no host-env substitution)
- #25: docker-compose.yml REDIS_URL + docs/developer-runbook.md created
- #26: e2e/dev-system/rbac-data-access.spec.ts (12 tests, 3 roles × 4 procedures)

Quality gates: tsc clean, api 1447/1447, web 189/189 passing.
Turbo concurrency capped at 2 (package.json) to prevent OOM under
parallel test runs.

Co-Authored-By: claude-flow <ruv@ruv.net>

apps/web/src/app/api/perf/route.ts

@@ -7,7 +7,9 @@ export const runtime = "nodejs";
 /**
  * GET /api/perf — Runtime performance metrics.
  *
- * Protected by CRON_SECRET header or query param.
+ * Protected by CRON_SECRET via `Authorization: Bearer <secret>` header only.
+ * Query-string authentication is not supported (secrets must not appear in URLs).
+ * Fails closed (401) when CRON_SECRET is not configured in the environment.
  * Returns Node.js memory usage, process uptime, and SSE connection count.
  */
 export function GET(request: Request) {