[Ops] Pre-launch security review

**Phase 4 — Production operations.**

Security review before launch.

### Scope
- [ ] Token TTL review; key rotation/revocation verified (from #21).
- [ ] CSRF coverage on all mutations.
- [ ] Rate-limit sensitive IAM endpoints.
- [ ] Permission-bypass test pass (attempt cross-team reads/writes, token replay, plane confusion).

### Acceptance
Security review signed off; bypass attempts fail in tests.

### Production acceptance criteria (SSO/IAM)
- [ ] No shared HS256 secret survives anywhere — mint + bench verify both on RS256/JWKS.
- [ ] A compromised single bench cannot forge tokens for other benches.
- [ ] `sso_allow_insecure_hs256` is gone/inert in prod; mint fails closed without RS256.
- [ ] Token replay window bounded (TTL); audience + issuer strictly verified.