[Bccorb]

Fixes the six API findings from the v0.21 security review (epic #558). Each was reproduced on main first: every issue has a test(...) commit that fails there, followed by its fix. The test commits were made with --no-verify, because the pre-commit hook runs the full coverage suite and a deliberately failing test cannot pass it. Lint, format, typecheck and commitlint were run on them by hand, and every fix commit went through the hook.

Closes #552
Closes #554
Closes #555
Closes #557
Refs #553 (partly: the shared rate-limit store stays open)
Refs #556 (parts 1 and 3: the delivery token subject stays open)

The release PR #566 is untouched. This merges to main and ships with v0.23.0 when the milestone is done.

Review first

• Derive hardware-bound passkey assurance from the registered credential #552 changes token claim values. Device binding now comes from the stored deviceType, and counts only when attestation was verified. Deployments on the default none attestation, and credentials registered before the device type was stored, now get acr=phr / amr=swk instead of phrh / hwk. A relying party that requires phrh stops being satisfied unless the deployment verifies attestation. An assertion whose backup-eligible flag differs from registration gets 401.
• Keep application notice text from carrying its own links and attribution #554 refuses filename-like words. Notice text with a URL scheme, www., a dotted domain (including fullwidth dots) or an email is refused with 400. That also refuses Node.js or file.txt. @seamless-auth/types does not carry the rule yet, so SDK-side validation will not catch it.

The rest

• Key the application notice per-user limit on the canonical user id #553 The per-user notice limit keys on the lower-cased user id. Rate limiters are still in-memory per instance; docs/production-operations.md now says notice limits multiply by the instance count. A shared store is a design decision left on the issue.
• Keep application notice text from carrying its own links and attribution #554 The notice opens with Sent by <app> through <instance>. instead of ending with it.
• Enforce third_party_clients_enabled when serving and signing for existing clients #555 findActiveOidcClient treats a third-party client as inactive while third_party_clients_enabled is off, covering metadata, secret checks, signing, notice tokens, links and back-channel logout.
• Harden secret responses, external delivery tokens and provider fetches outside production #556 Every response carries Cache-Control: no-store by default (JWKS and hashed dashboard assets keep their own). providerFetch uses the guarded socket in every mode: outside production, link-local, unspecified and fe80::/10 addresses are refused, named or resolved, and the 1 MB cap and 10 s timeout apply. Part 2 (requiring the seamless-auth-external-delivery subject) is not done: it would break the seamless-cli conformance harness, which mints sub: seamless-verify. The reproducing test stays as it.fails with TODO(#556) in tests/unit/lib/externalDelivery.spec.ts.
• Send owner notice kinds the adapter does not deliver #557 Owner notice kinds the adapter does not advertise are sent directly when the API has a transport for that channel (canSendNoticeDirectly), otherwise recorded as not_sent_external_delivery. A recovery that used to fail with 503 recovery_notice_failed for that reason now goes ahead. Admin identity-change notices in identityChangeService.ts are unchanged.

Changesets: #552, #554, #555 and #557 are minor because they change existing behavior. The others are patch.

Checks

Unit suite 2833 passed (1 expected fail, 1 todo). Postgres suite 2891 passed. Coverage 99.03% statements, 95.82% branches. format, lint, typecheck, build pass, and generate:api shows no drift.