0.2.46: security hardening (external-fund scope, role guards, forced password rotation, headers)

Pre-release audit fixes:
- External Administrators can only act on investors already in their own funds
  (grant_access, create_statement, set_partner_exited, import match), closing a
  cross-fund account-takeover chain.
- Role and is_active changes are gated: no self-escalation, non-approvers cannot
  mint or alter approver accounts, and the Service Admin is protected.
- must_change_password is enforced server-side, not just in the client.
- Session cookie is Secure with a 12h max-age and SameSite; CSP and standard
  security headers on every response; the app refuses to boot on a known or short
  session secret; uvicorn runs with proxy-headers so login throttling keys on the
  real client IP behind the platform proxy.
- Import preview no longer confirms cross-fund investors; no-store on document
  downloads.
- Adds backend/tests/test_security_hardening.py (15 tests); full suite 76 passing.
- SECURITY-AUDIT.md records the swarm audit, findings, and remediation status.

deploy/Dockerfile

@@ -42,6 +42,8 @@ RUN groupadd --gid 10001 appuser \
 ENV TEN31_DB_PATH=/data/portal.db
 ENV TEN31_DOCS_DIR=/data/documents
 ENV TEN31_SESSION_SECRET=change-me
+# Served behind the platform's TLS-terminating proxy, so the session cookie is Secure.
+ENV TEN31_SESSION_COOKIE_SECURE=true
 
 EXPOSE 8000