fix(security): server-authoritative approval gate + auth/session/file hardening

Remediate the HIGH and security-relevant findings from the 2026-07-11 audit.

H1 — the per-env approval gate is now server-authoritative. The governing
project is resolved from the target node's nearest-claimed ancestor
(`governing_env_policy`/`_tree` + `governing_project_id` +
`ProjectRepository::get_environments_by_id`), independent of the client-supplied
`[project]`. Omitting or spoofing the project block can no longer skip a gate the
owning project established; a to-create group resolves its declared parent's
chain so a fresh subtree node inherits the gate. Fails closed on any read error.

H2 — the API-key prefix slice (`&rest[..8]`) is now the boundary-safe
`rest.get(..8)`, so an attacker-supplied multibyte bearer can't panic the request
task (unauthenticated per-request DoS). Regression test added.

C1 — admin sessions gain an absolute lifetime cap (migration 0070,
`PICLOUD_SESSION_ABSOLUTE_TTL_HOURS`, default 30d): `lookup` filters it, `touch`
clamps the sliding bump to it, so a continuously-used or stolen-but-warm token
self-expires. Mirrors the data-plane app-user cap.

C2 — `Cache-Control: no-store` on the login and API-key-mint responses (the two
that return a raw credential), so a proxy/CDN/browser cache can't retain it.

B8 — file downloads are header-safe: `sanitize_stored_filename` guarantees a
valid `HeaderValue` (no panic on a control-char name) and BOTH the per-app and
group download paths now set attachment + `X-Content-Type-Options: nosniff` +
a restrictive CSP, closing a group-path stored-XSS gap.

Also folds in the server-side plan-warning plumbing (`plan_warnings`,
`PlanResult::warnings`) and the `app_only_reject` message helper that the CLI
plan-preview change builds on, plus operator security notes (reads-open shared-
topic SSE; the `--env` label is advisory, not a boundary).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_api.rs

@@ -231,12 +231,15 @@ async fn apply_handler(
 ) -> Result<Json<ApplyReport>, ApplyError> {
     let app_id = resolve_app_id(svc.apps.as_ref(), &id_or_slug).await?;
     require_app_node_writes(&svc, &principal, app_id, &req.bundle, req.prune).await?;
-    // §3 M3: server-authoritative per-env approval gate, evaluated against the
-    // persisted ∪ declared policy (hermetic — an omitted policy can't bypass a
-    // gate a prior apply established). If gated and approved, the override
-    // additionally requires ADMIN on the node (a step up from the editor write
-    // caps above) + is audited.
-    let policy = svc.effective_env_policy(req.project.as_ref()).await?;
+    // §3 M3: server-authoritative per-env approval gate. The governing policy is
+    // loaded from the project the SERVER resolves as owning this node (its
+    // nearest-claimed ancestor), unioned with the declared policy — so a request
+    // that omits or spoofs `[project]` can't bypass a gate the owning project
+    // established. If gated and approved, the override additionally requires
+    // ADMIN on the node (a step up from the editor write caps above) + is audited.
+    let policy = svc
+        .governing_env_policy(ApplyOwner::App(app_id), req.project.as_ref())
+        .await?;
     if env_gate_check(&policy, req.env.as_deref(), &req.approved_envs)? {
         require(svc.authz.as_ref(), &principal, Capability::AppAdmin(app_id))
             .await
@@ -320,9 +323,11 @@ async fn group_apply_handler(
     let group_id = resolve_group_id(svc.groups.as_ref(), &id_or_slug).await?;
     svc.require_group_node_writes(&principal, group_id, &req.bundle, req.prune)
         .await?;
-    // §3 M3: per-env approval gate (persisted ∪ declared) — an approved gated
-    // apply requires GroupAdmin.
-    let policy = svc.effective_env_policy(req.project.as_ref()).await?;
+    // §3 M3: per-env approval gate (governing ∪ declared, server-resolved owner)
+    // — an approved gated apply requires GroupAdmin.
+    let policy = svc
+        .governing_env_policy(ApplyOwner::Group(group_id), req.project.as_ref())
+        .await?;
     if env_gate_check(&policy, req.env.as_deref(), &req.approved_envs)? {
         require(
             svc.authz.as_ref(),
@@ -406,10 +411,14 @@ async fn tree_apply_handler(
     Json(req): Json<TreeApplyRequest>,
 ) -> Result<Json<ApplyReport>, ApplyError> {
     authz_tree(&svc, &principal, &req.bundle, Some(req.prune)).await?;
-    // §3 M3: server-authoritative per-env approval gate (persisted ∪ declared).
-    // On an approved gated apply, require ADMIN on EVERY declared node (a step up
-    // from the editor write caps authz_tree checks) + audit.
-    let policy = svc.effective_env_policy(req.project.as_ref()).await?;
+    // §3 M3: server-authoritative per-env approval gate (governing ∪ declared).
+    // The governing side is the union of every declared node's owning-project
+    // policy, resolved server-side — omitting `[project]` can't dodge it. On an
+    // approved gated apply, require ADMIN on EVERY declared node (a step up from
+    // the editor write caps authz_tree checks) + audit.
+    let policy = svc
+        .governing_env_policy_tree(&req.bundle, req.project.as_ref())
+        .await?;
     if env_gate_check(&policy, req.env.as_deref(), &req.approved_envs)? {
         require_admin_on_every_node(&svc, &principal, &req.bundle).await?;
         audit_gated_apply(&principal, req.env.as_deref(), req.bundle.nodes.len());
@@ -432,10 +441,11 @@ async fn tree_apply_handler(
 }
 
 /// §3 M3 (hermetic gate): the per-env approval gate, evaluated against the
-/// EFFECTIVE policy (`persisted ∪ declared`, built by
-/// `ApplyService::effective_env_policy`) — the persisted side is authoritative,
-/// so a request that omits or weakens the policy can't bypass a gate a prior
-/// apply established. Returns `Ok(true)` when the target env is confirm-required
+/// EFFECTIVE policy (`governing ∪ declared`, built by
+/// `ApplyService::governing_env_policy`) — the governing side is loaded from the
+/// project the SERVER resolves as owning the node, so a request that omits or
+/// weakens `[project]` can't bypass a gate the owning project established.
+/// Returns `Ok(true)` when the target env is confirm-required
 /// AND approved — the caller must then require admin + audit. `Ok(false)` when
 /// not gated (no env, or `confirm = false` everywhere). `Err(ApprovalRequired)`
 /// when gated and NOT in `approved_envs` (a blanket `--yes` never lands here).