0.2.46: security hardening (external-fund scope, role guards, forced password rotation, headers)

Pre-release audit fixes:
- External Administrators can only act on investors already in their own funds
  (grant_access, create_statement, set_partner_exited, import match), closing a
  cross-fund account-takeover chain.
- Role and is_active changes are gated: no self-escalation, non-approvers cannot
  mint or alter approver accounts, and the Service Admin is protected.
- must_change_password is enforced server-side, not just in the client.
- Session cookie is Secure with a 12h max-age and SameSite; CSP and standard
  security headers on every response; the app refuses to boot on a known or short
  session secret; uvicorn runs with proxy-headers so login throttling keys on the
  real client IP behind the platform proxy.
- Import preview no longer confirms cross-fund investors; no-store on document
  downloads.
- Adds backend/tests/test_security_hardening.py (15 tests); full suite 76 passing.
- SECURITY-AUDIT.md records the swarm audit, findings, and remediation status.

backend/ten31portal/routers/entity_router.py

@@ -7,8 +7,9 @@ from sqlmodel import Session, col, select
 
 from ten31portal.audit import record_audit
 from ten31portal.auth import (
-    accessible_entity_ids, check_administrator_scope, get_current_user, household_user_ids,
-    require_entity_writer, require_internal, require_internal_or_administrator, require_writer,
+    accessible_entity_ids, check_administrator_scope, check_target_investor_scope,
+    get_current_user, household_user_ids, require_entity_writer, require_internal,
+    require_internal_or_administrator, require_writer,
 )
 from ten31portal.database import get_session
 from ten31portal.models import (
@@ -178,6 +179,9 @@ def set_partner_exited(
     member = session.get(User, user_id)
     if member is None or member.role != UserRole.investor:
         raise HTTPException(status_code=400, detail="Only investor members can be marked exited")
+    # Marking an exit can mint an access grant (below); an external Administrator may only do
+    # that for an investor already inside their scope, never to pull in an out-of-fund account.
+    check_target_investor_scope(admin, user_id, session)
 
     access = session.exec(
         select(EntityAccess).where(