fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

docker-compose.yml

@@ -11,6 +11,7 @@ services:
       # deletion ledger used to detect and re-delete resurrected accounts.
       - jobtracker_deletion_tombstones:/account-lifecycle/tombstones
     environment:
+      - ASPNETCORE_ENVIRONMENT=Production
       - ASPNETCORE_URLS=http://+:8080
       - Data__Root=/data
       - Exports__DailyFolder=/data/exports
@@ -134,13 +135,14 @@ services:
         - NEXT_PUBLIC_API_BASE_URL=${NEXT_PUBLIC_API_BASE_URL:-}
     expose:
       - "80"
-    # Compatibility ingress for the current production reverse proxy, which
-    # targets the host's port 3000 rather than Docker service discovery. Keep
-    # this until the operator-owned proxy is migrated onto jobtracker_shared.
+    # Traefik currently targets host port 3000. Nginx admits only explicitly
+    # configured Traefik socket peers; Host/forwarded headers alone never grant access.
     ports:
       - "3000:80"
     environment:
       - APP_PUBLIC_BASE_URL=${APP_PUBLIC_BASE_URL}
+      - INGRESS_MODE=proxy
+      - INGRESS_PROXY_CIDRS=${INGRESS_PROXY_CIDRS:-}
     depends_on:
       backend:
         condition: service_healthy