fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

JobTrackerApi/Services/CsvCellSafety.cs

@@ -0,0 +1,21 @@
+using System.Globalization;
+using System.Text;
+
+namespace JobTrackerApi.Services;
+
+public static class CsvCellSafety
+{
+    // Apply to text before CSV quoting, never to stored data or typed numbers/dates.
+    // Prefix before (not instead of) whitespace/controls; an existing apostrophe is safe.
+    public static string SpreadsheetText(string? value)
+    {
+        if (string.IsNullOrEmpty(value)) return value ?? "";
+        foreach (var rune in value.EnumerateRunes())
+        {
+            if (Rune.IsWhiteSpace(rune) || Rune.IsControl(rune) || Rune.GetUnicodeCategory(rune) == UnicodeCategory.Format)
+                continue;
+            return rune.Value is '=' or '+' or '-' or '@' ? "'" + value : value;
+        }
+        return value;
+    }
+}