Complete launch-candidate validation and operations readiness

## Parent

#572

## What to build

Complete the final launch-candidate validation and operating readiness review using the exact production artifact. Establish supported runtime versions, privacy-aware observability, accessibility and performance baselines, recovery evidence, incident ownership, and explicit product/engineering sign-off.

## Acceptance criteria

- [ ] Node 22 and the package-manager version declared by the project are consistently pinned across development, CI, and Docker.
- [ ] Production Sentry sampling is environment-specific and authorization data, IPs, filenames, URLs, and other PII are scrubbed.
- [ ] Automated axe and targeted keyboard E2E scenarios cover navigation, filtering, dialogs, share actions, and tenant/entity selection.
- [ ] Staging passes dependency, DAST, accessibility, and production-like load tests against agreed targets.
- [ ] Query plans and indexes for hot promise queries are validated with production-like data.
- [ ] Backup restoration and immutable-image rollback are successfully rehearsed and recorded.
- [ ] Runbooks cover incident ownership, RPO/RTO, credential rotation, capacity, and degraded behavior for MongoDB, Tika, S3, SMTP, Airtable, Meedan, and AI providers.
- [ ] Product and engineering record a final go/no-go decision for the exact tested artifact.

## Blocked by

- #573
- #574
- #575
- #576
- #577
- #578
- #579
- #580

Start with parent issue #572 and review the blocked issues #573–#580 to understand the validation inputs and exact production artifact. Work through the acceptance checklist across CI, Docker, staging, observability, accessibility, data, recovery, and runbooks; done requires recorded evidence for each item and an explicit product/engineering go/no-go decision.

Written by the indexing model from the issue text.