fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

docs/architecture/deployment.md

@@ -7,14 +7,23 @@ stack, and performs health checks. The protected production workflow explicitly
 so application and AI contracts always come from the same tested commit.
 
 Production commands explicitly select `docker-compose.yml`. The operator-owned reverse proxy still
-targets frontend/nginx through compatibility port 3000; the host firewall blocks direct external access.
-Traefik must match the canonical Host exactly and
-must replace `X-Forwarded-For` and `X-Forwarded-Proto`. Nginx passes those sanitized values to the
-backend over the dedicated `WEB_PROXY_SUBNET`; nginx also derives its only application server name
-from `APP_PUBLIC_BASE_URL` and rejects unknown Hosts except its liveness endpoint. The backend trusts
-only the dedicated CIDR and one forwarded hop. Local development explicitly adds
+targets frontend/nginx through compatibility port 3000. Whether the deployed firewall blocks direct
+external access requires host verification; the repository cannot prove it. Production nginx now
+requires `INGRESS_PROXY_CIDRS`, an explicit allowlist of the **observed socket peers** belonging to
+Traefik. Canonical Host and forwarded headers alone do not grant access. Traefik must match the canonical
+Host, terminate TLS and replace forwarding headers with one client IP and `https`. Nginx uses its
+realip module only for those peers, emits one normalized IP and canonical scheme/Host to the backend,
+and rejects untrusted application requests and multi-hop chains. Empty peer configuration fails startup
+and the deployment preflight. The default-host `/health` remains a local/container liveness exception.
+This repository change still awaits real nginx/container and production topology verification; see
+[B06 evidence and exact operator procedure](../audits/2026-09-07/validation/b06-completion.md).
+
+Nginx reaches the backend over dedicated `WEB_PROXY_SUBNET`; the backend trusts that CIDR for one hop,
+ignores forwarded Host and validates the canonical application Host in Production. Public URLs and
+cookie security use `APP_PUBLIC_BASE_URL`. Production CORS defaults to that same origin and rejects
+noncanonical overrides. Local development explicitly adds
 `docker-compose.dev.yml`, which publishes ports 3000/5202, uses the localhost origin, and disables
-forwarded-header trust.
+forwarded-header trust with nginx's `INGRESS_MODE=direct`.
 
 Each service rotates local Docker logs at 10 MB and retains three files. Add a central sink only if
 cross-host search or longer retention becomes necessary.