0.2.46: security hardening (external-fund scope, role guards, forced password rotation, headers)

Pre-release audit fixes:
- External Administrators can only act on investors already in their own funds
  (grant_access, create_statement, set_partner_exited, import match), closing a
  cross-fund account-takeover chain.
- Role and is_active changes are gated: no self-escalation, non-approvers cannot
  mint or alter approver accounts, and the Service Admin is protected.
- must_change_password is enforced server-side, not just in the client.
- Session cookie is Secure with a 12h max-age and SameSite; CSP and standard
  security headers on every response; the app refuses to boot on a known or short
  session secret; uvicorn runs with proxy-headers so login throttling keys on the
  real client IP behind the platform proxy.
- Import preview no longer confirms cross-fund investors; no-store on document
  downloads.
- Adds backend/tests/test_security_hardening.py (15 tests); full suite 76 passing.
- SECURITY-AUDIT.md records the swarm audit, findings, and remediation status.

backend/ten31portal/routers/capital_import_router.py

@@ -20,7 +20,10 @@ from sqlmodel import Session, select
 
 from ten31portal import config, storage
 from ten31portal.audit import record_audit
-from ten31portal.auth import check_administrator_scope, hash_password, require_admin
+from ten31portal.auth import (
+    check_administrator_scope, check_target_investor_scope, hash_password, require_admin,
+    visible_investor_ids,
+)
 from ten31portal.database import get_session
 from ten31portal.models import (
     CapitalAccountStatement, Entity, EntityAccess, User, UserRole,
@@ -232,6 +235,15 @@ def preview_import(
     if entity_id is not None and session.get(Entity, entity_id) is None:
         raise HTTPException(status_code=404, detail="Entity not found")
 
+    # An external Administrator must name one of their funds, and may only be shown matches
+    # against investors already inside their scope. Otherwise the name-matching would confirm
+    # which uploaded names correspond to real accounts (and their usernames) in other funds.
+    scope_ids = visible_investor_ids(admin, session)
+    if scope_ids is not None and entity_id is None:
+        raise HTTPException(
+            status_code=400, detail="Select one of your funds before previewing an import."
+        )
+
     try:
         file_bytes = storage.read_capped(file)
     except storage.UploadTooLarge as exc:
@@ -239,6 +251,8 @@ def preview_import(
     wb = _open_workbook(file_bytes, password)
 
     investors = session.exec(select(User).where(User.role == UserRole.investor)).all()
+    if scope_ids is not None:
+        investors = [u for u in investors if u.id in scope_ids]
     by_name = {u.name.strip().lower(): u for u in investors}
     by_username = {u.username.strip().lower(): u for u in investors}
     by_extid = {u.external_investor_id: u for u in investors if u.external_investor_id}
@@ -340,6 +354,9 @@ def commit_import(
             user = session.get(User, inv.user_id) if inv.user_id else None
             if user is None or user.role != UserRole.investor:
                 raise HTTPException(status_code=400, detail="match requires a valid investor user_id.")
+            # An external Administrator can only match an investor already inside their scope;
+            # a new investor for their fund must go through the "create" action instead.
+            check_target_investor_scope(admin, user.id, session)
             if inv.external_id and not user.external_investor_id:
                 user.external_investor_id = inv.external_id
                 session.add(user)