feat(security): audit batch C — data posture, retention, DP keys (#22)

src/InboxIntel.Api/Program.cs

@@ -27,9 +27,20 @@ builder.Host.UseSerilog((ctx, cfg) => cfg
     .WriteTo.Console());
 
 // Persist Data Protection keys so encrypted refresh tokens survive restarts.
-builder.Services.AddDataProtection()
+// AUDIT M-3: optionally encrypt the Data Protection key ring with an X.509 certificate so
+// the keys are not readable in plaintext from the /keys volume (which would otherwise let
+// anyone with volume access decrypt all stored refresh tokens). Configure
+// DataProtection:CertificatePath (+ CertificatePassword) to enable; without it, keys are
+// persisted unprotected and a startup warning documents the residual risk.
+var dp = builder.Services.AddDataProtection()
     .PersistKeysToFileSystem(new DirectoryInfo(builder.Configuration["DataProtection:KeyPath"] ?? "/keys"))
     .SetApplicationName("InboxIntel");
+var dpCertPath = builder.Configuration["DataProtection:CertificatePath"];
+if (!string.IsNullOrWhiteSpace(dpCertPath))
+{
+    dp.ProtectKeysWithCertificate(new System.Security.Cryptography.X509Certificates.X509Certificate2(
+        dpCertPath, builder.Configuration["DataProtection:CertificatePassword"]));
+}
 
 builder.Services.AddApplication();
 builder.Services.AddInfrastructure(builder.Configuration);