fix(security): server-authoritative approval gate + auth/session/file hardening

Remediate the HIGH and security-relevant findings from the 2026-07-11 audit.

H1 — the per-env approval gate is now server-authoritative. The governing
project is resolved from the target node's nearest-claimed ancestor
(`governing_env_policy`/`_tree` + `governing_project_id` +
`ProjectRepository::get_environments_by_id`), independent of the client-supplied
`[project]`. Omitting or spoofing the project block can no longer skip a gate the
owning project established; a to-create group resolves its declared parent's
chain so a fresh subtree node inherits the gate. Fails closed on any read error.

H2 — the API-key prefix slice (`&rest[..8]`) is now the boundary-safe
`rest.get(..8)`, so an attacker-supplied multibyte bearer can't panic the request
task (unauthenticated per-request DoS). Regression test added.

C1 — admin sessions gain an absolute lifetime cap (migration 0070,
`PICLOUD_SESSION_ABSOLUTE_TTL_HOURS`, default 30d): `lookup` filters it, `touch`
clamps the sliding bump to it, so a continuously-used or stolen-but-warm token
self-expires. Mirrors the data-plane app-user cap.

C2 — `Cache-Control: no-store` on the login and API-key-mint responses (the two
that return a raw credential), so a proxy/CDN/browser cache can't retain it.

B8 — file downloads are header-safe: `sanitize_stored_filename` guarantees a
valid `HeaderValue` (no panic on a control-char name) and BOTH the per-app and
group download paths now set attachment + `X-Content-Type-Options: nosniff` +
a restrictive CSP, closing a group-path stored-XSS gap.

Also folds in the server-side plan-warning plumbing (`plan_warnings`,
`PlanResult::warnings`) and the `app_only_reject` message helper that the CLI
plan-preview change builds on, plus operator security notes (reads-open shared-
topic SSE; the `--env` label is advisory, not a boundary).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/admin_session_repo.rs

@@ -17,13 +17,15 @@ pub enum AdminSessionRepositoryError {
     Db(#[from] sqlx::Error),
 }
 
-/// Result of a session lookup. Includes the user id (for auth context)
-/// and the existing `expires_at` so the middleware can decide whether
-/// the sliding window bump is worth a write.
+/// Result of a session lookup. Includes the user id (for auth context),
+/// the existing `expires_at` (so the middleware can decide whether the
+/// sliding-window bump is worth a write), and the `absolute_expires_at`
+/// hard cap the bump must clamp at (C1).
 #[derive(Debug, Clone)]
 pub struct AdminSessionLookup {
     pub user_id: AdminUserId,
     pub expires_at: DateTime<Utc>,
+    pub absolute_expires_at: DateTime<Utc>,
 }
 
 #[async_trait]
@@ -33,9 +35,11 @@ pub trait AdminSessionRepository: Send + Sync {
         user_id: AdminUserId,
         token_hash: &str,
         expires_at: DateTime<Utc>,
+        absolute_expires_at: DateTime<Utc>,
     ) -> Result<(), AdminSessionRepositoryError>;
     /// Look up a session by token hash. Returns `None` for missing or
-    /// already-expired rows (the query filters them).
+    /// already-expired rows — either the sliding `expires_at` OR the
+    /// absolute cap having passed (the query filters both).
     async fn lookup(
         &self,
         token_hash: &str,
@@ -78,14 +82,16 @@ impl AdminSessionRepository for PostgresAdminSessionRepository {
         user_id: AdminUserId,
         token_hash: &str,
         expires_at: DateTime<Utc>,
+        absolute_expires_at: DateTime<Utc>,
     ) -> Result<(), AdminSessionRepositoryError> {
         sqlx::query(
-            "INSERT INTO admin_sessions (token_hash, user_id, expires_at) \
-             VALUES ($1, $2, $3)",
+            "INSERT INTO admin_sessions (token_hash, user_id, expires_at, absolute_expires_at) \
+             VALUES ($1, $2, $3, $4)",
         )
         .bind(token_hash)
         .bind(user_id.into_inner())
         .bind(expires_at)
+        .bind(absolute_expires_at)
         .execute(&self.pool)
         .await?;
         Ok(())
@@ -95,16 +101,17 @@ impl AdminSessionRepository for PostgresAdminSessionRepository {
         &self,
         token_hash: &str,
     ) -> Result<Option<AdminSessionLookup>, AdminSessionRepositoryError> {
-        let row: Option<(uuid::Uuid, DateTime<Utc>)> = sqlx::query_as(
-            "SELECT user_id, expires_at FROM admin_sessions \
-             WHERE token_hash = $1 AND expires_at > NOW()",
+        let row: Option<(uuid::Uuid, DateTime<Utc>, DateTime<Utc>)> = sqlx::query_as(
+            "SELECT user_id, expires_at, absolute_expires_at FROM admin_sessions \
+             WHERE token_hash = $1 AND expires_at > NOW() AND absolute_expires_at > NOW()",
         )
         .bind(token_hash)
         .fetch_optional(&self.pool)
         .await?;
-        Ok(row.map(|(uid, exp)| AdminSessionLookup {
+        Ok(row.map(|(uid, exp, abs)| AdminSessionLookup {
             user_id: uid.into(),
             expires_at: exp,
+            absolute_expires_at: abs,
         }))
     }
 
@@ -144,9 +151,12 @@ impl AdminSessionRepository for PostgresAdminSessionRepository {
     }
 
     async fn prune_expired(&self) -> Result<u64, AdminSessionRepositoryError> {
-        let res = sqlx::query("DELETE FROM admin_sessions WHERE expires_at <= NOW()")
-            .execute(&self.pool)
-            .await?;
+        let res = sqlx::query(
+            "DELETE FROM admin_sessions \
+             WHERE expires_at <= NOW() OR absolute_expires_at <= NOW()",
+        )
+        .execute(&self.pool)
+        .await?;
         Ok(res.rows_affected())
     }
 }