fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

JobTrackerApi/Controllers/AuthController.cs

@@ -97,6 +97,7 @@ public sealed class AuthController : ControllerBase
         public string AppVersion { get; init; } = "unknown";
         public string? AppCommitSha { get; init; }
         public string UiLanguage { get; init; } = "en";
+        public string? SessionContext { get; init; }
     }
     public sealed record PendingEmailChangeResult(string? PendingEmail, DateTimeOffset? RequestedAtUtc);
     private const int MaxAvatarBytes = 1_000_000;
@@ -467,6 +468,7 @@ public sealed class AuthController : ControllerBase
 
     [HttpGet("me")]
     [Authorize]
+    [ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)]
     public async Task<IActionResult> Me(CancellationToken cancellationToken)
     {
         var user = await _users.GetUserAsync(User);
@@ -1234,6 +1236,7 @@ public sealed class AuthController : ControllerBase
 
     private MeResult WithBuildMetadata(MeResult result, bool include)
     {
+        result = result with { SessionContext = User.FindFirstValue("sid") };
         if (!include) return result;
 
         return result with