fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

JobTrackerApi.Tests/CvExportRetentionTests.cs

@@ -3,6 +3,7 @@ using JobTrackerApi.Services;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
 using Moq;
 using Xunit;
 
@@ -30,7 +31,8 @@ public sealed class CvExportRetentionTests
             var config = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?> { ["Data:Root"] = root }).Build();
             var environment = new Mock<IHostEnvironment>();
             environment.SetupGet(x => x.ContentRootPath).Returns(root);
-            var exporter = new PlaywrightCvPdfExporter(new AppPaths(config, environment.Object), NullLogger<PlaywrightCvPdfExporter>.Instance, config);
+            var exporter = new PlaywrightCvPdfExporter(new AppPaths(config, environment.Object), NullLogger<PlaywrightCvPdfExporter>.Instance, config,
+                new PdfRenderAdmission(Options.Create(new PdfRenderOptions()), NullLogger<PdfRenderAdmission>.Instance), Mock.Of<IHostApplicationLifetime>());
             var prune = typeof(PlaywrightCvPdfExporter).GetMethod("PruneExpiredExports", BindingFlags.Instance | BindingFlags.NonPublic)!;
 
             prune.Invoke(exporter, [new DateOnly(2026, 7, 1)]);