F-16 [Medium] CODEOWNERS file exists but is not enforced (placeholder teams + no branch protection)

## Summary\n\nThe repository has no `.github/CODEOWNERS` file. Security-critical paths — authentication, authorization, infrastructure, and CI/CD workflows — have no required reviewer enforcement on pull requests. Any contributor can merge changes to these paths without a domain owner review.\n\n## Impact\n\nSecurity and infrastructure changes can be merged without expert review. No automated ownership enforcement for high-risk paths.\n\n## Fix\n\nCreate `.github/CODEOWNERS` covering at minimum:\n\n```\n# Auth and authorization\nsrc/**/Auth/ @security-team\nsrc/**/Authorization/ @security-team\n\n# Infrastructure\ninfra/ @platform-team\n\n# CI/CD workflows\n.github/workflows/ @platform-team\n\n# Application settings\n**/appsettings*.json @platform-team\n```\n\n## References\n\n- Audit artifact: `spin-agent-full-audit.md` (project artifact 1e910fcc580a4cb0)\n- Auditor: Thor

Start by checking whether .github/CODEOWNERS exists and review GitHub's CODEOWNERS and branch protection settings. Add coverage for the listed authentication, authorization, infrastructure, workflow, and appsettings paths, then verify that the referenced teams exist and required reviews are enforced on protected branches.

Written by the indexing model from the issue text.