security: remove the public demo bearer and establish real authorization boundaries

Why this is a release blocker

The production dashboard currently embeds a JWT with no expiry. The documented generator signs that token with JWT_SECRET, and the frontend copies it into localStorage. The API verifies the HS256 signature but does not enforce role, tenant, issuer, audience, or an authorized subscription.

That means the advertised viewer token can call write endpoints once the suspended API is restored. The current schema and repository methods are also globally scoped, so the service cannot safely serve more than one organization.

Audit evidence: frontend/src/App.jsx:16-24, scripts/generate_demo_jwt.py:3-38, api/app.py:160-191, api/routes/scans.py:62-93, and alembic/versions/b3f1a2c4d5e6_baseline_schema.py:23-80.

Required work

Immediate containment

• Keep the API suspended until the exposed token is removed.
• Remove VITE_JWT_TOKEN and the automatic dev-local-token bootstrap.
• Rotate JWT_SECRET and audit any available access logs.
• Do not put bearer credentials in Vite build-time variables or localStorage.

Durable boundary

• Adopt Entra/OIDC Authorization Code + PKCE (or another approved enterprise IdP flow).
• Validate issuer, audience, subject, expiry and tenant using JWKS.
• Define viewer, operator and administrator policies and enforce them server-side.
• Persist organization/tenant, requester and authorized subscription ownership.
• Require tenant/subscription context in every repository query; evaluate PostgreSQL RLS.
• If the first enterprise release is intentionally single-tenant, enforce a configured subscription allowlist and document that boundary.

Acceptance criteria

• No credential or reusable session secret is present in public JS.
• Expired, wrong-issuer, wrong-audience and role-inappropriate tokens are rejected.
• A user cannot read or trigger work for an unauthorized subscription.
• Cross-tenant integration tests cover scans, findings, compliance, resources, drift, AI and enrichment routes.
• Secret rotation and incident-containment steps are documented and exercised.
• The API is not restored until the containment checklist is complete.

Related: #243.