fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

JobTrackerApi/Controllers/AuthController.cs

@@ -97,6 +97,7 @@ public sealed class AuthController : ControllerBase
         public string AppVersion { get; init; } = "unknown";
         public string? AppCommitSha { get; init; }
         public string UiLanguage { get; init; } = "en";
+        public string? SessionContext { get; init; }
     }
     public sealed record PendingEmailChangeResult(string? PendingEmail, DateTimeOffset? RequestedAtUtc);
     private const int MaxAvatarBytes = 1_000_000;
@@ -467,6 +468,7 @@ public sealed class AuthController : ControllerBase
 
     [HttpGet("me")]
     [Authorize]
+    [ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)]
     public async Task<IActionResult> Me(CancellationToken cancellationToken)
     {
         var user = await _users.GetUserAsync(User);
@@ -1234,6 +1236,7 @@ public sealed class AuthController : ControllerBase
 
     private MeResult WithBuildMetadata(MeResult result, bool include)
     {
+        result = result with { SessionContext = User.FindFirstValue("sid") };
         if (!include) return result;
 
         return result with

JobTrackerApi/Controllers/ExportController.cs

@@ -83,6 +83,7 @@ namespace JobTrackerApi.Controllers
                     var q = s.Replace("\"", "\"\"");
                     return needs ? $"\"{q}\"" : q;
                 }
+                static string Text(string? s) => Esc(CsvCellSafety.SpreadsheetText(s));
 
                 var sb = new StringBuilder();
                 sb.AppendLine(string.Join(",",
@@ -108,27 +109,28 @@ namespace JobTrackerApi.Controllers
                 foreach (var j in jobs)
                 {
                     sb.AppendLine(string.Join(",",
-                        Esc(j.Company?.Name),
-                        Esc(j.Company?.Location),
-                        Esc(j.Company?.Source),
-                        Esc(j.JobTitle),
-                        Esc(j.Status),
+                        Text(j.Company?.Name),
+                        Text(j.Company?.Location),
+                        Text(j.Company?.Source),
+                        Text(j.JobTitle),
+                        Text(j.Status),
                         Esc(j.DateApplied?.ToString("o")),
-                        Esc(j.Location),
-                        Esc(j.Salary),
+                        Text(j.Location),
+                        Text(j.Salary),
                         Esc(j.SalaryMin?.ToString(System.Globalization.CultureInfo.InvariantCulture)),
                         Esc(j.SalaryMax?.ToString(System.Globalization.CultureInfo.InvariantCulture)),
-                        Esc(j.SalaryCurrency),
-                        Esc(j.SalaryPeriod),
-                        Esc(j.NextAction),
+                        Text(j.SalaryCurrency),
+                        Text(j.SalaryPeriod),
+                        Text(j.NextAction),
                         Esc(j.FollowUpAt?.ToString("o")),
-                        Esc(j.JobUrl),
-                        Esc(j.Notes),
-                        Esc(j.CoverLetterText)
+                        Text(j.JobUrl),
+                        Text(j.Notes),
+                        Text(j.CoverLetterText)
                     ));
                 }
 
-                return File(Encoding.UTF8.GetBytes(sb.ToString()), "text/csv", $"job-tracker-export-{stamp}.csv");
+                // Excel's direct CSV open needs the UTF-8 BOM to preserve Norwegian text.
+                return File([.. Encoding.UTF8.GetPreamble(), .. Encoding.UTF8.GetBytes(sb.ToString())], "text/csv; charset=utf-8", $"job-tracker-export-{stamp}.csv");
             }
 
             return File(System.Text.Json.JsonSerializer.SerializeToUtf8Bytes(jobs), "application/json", $"job-tracker-export-{stamp}.json");