fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

docs/audits/2026-09-07/validation/evidence/b01-test-results.json

@@ -0,0 +1,46 @@
+{
+  "ticket": "B01",
+  "completedDate": "2026-09-08",
+  "baselineCommit": "7d641edc7bca866ccf06012897ba1d107c07e59f",
+  "environment": "Windows, .NET SDK 9.0.317, Release, existing packages, no external services",
+  "status": "complete locally; not deployed; F11 remains open for B07 and deployment evidence",
+  "runs": [
+    {
+      "phase": "before application edits, regression reproduction",
+      "path": ".artifacts/b01/b01-before.trx",
+      "total": 12,
+      "passed": 8,
+      "failed": 4,
+      "skipped": 0,
+      "sha256": "320B78B4A5A6E008B66D64661816F7A7F827BF48AEE69052C03D79989D631FA7"
+    },
+    {
+      "phase": "final focused import and existing IMAP literal guard tests",
+      "path": ".artifacts/b01/b01-focused.trx",
+      "total": 98,
+      "passed": 98,
+      "failed": 0,
+      "skipped": 0,
+      "sha256": "FE5BB3EB7A3D1D169C3C9B91AD46AF6B88868DE548D2AF3F228E30CBEC72B928"
+    },
+    {
+      "phase": "broader backend including focused cases",
+      "path": ".artifacts/b01/b01-backend.trx",
+      "total": 840,
+      "passed": 840,
+      "failed": 0,
+      "skipped": 0,
+      "excluded": ["JobTrackerApi.Tests.ImapServiceSsrfGuardTests.ConnectAsync_rejects_unresolvable_host_without_leaking_dns_detail"],
+      "exclusionReason": "Existing test performs real DNS resolution; external access was not authorized.",
+      "sha256": "379541860BFA4BFB819AF0BD172F23DEDDF26F003AD6A23F4906700DD333F022"
+    }
+  ],
+  "build": {
+    "command": "dotnet build JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore -warnaserror",
+    "exitCode": 0,
+    "warnings": 0,
+    "errors": 0
+  },
+  "newRegressionCases": 88,
+  "originalEvidencePreserved": true
+}