fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

docs/audits/2026-09-07/validation/evidence/b02-browser-config.ts.txt

@@ -0,0 +1,18 @@
+// Copy to .artifacts/b02/playwright.offline.config.ts and run from job-tracker-ui.
+import base from "../../job-tracker-ui/playwright.config";
+import path from "node:path";
+
+export default {
+  ...base,
+  testDir: path.join(process.cwd(), "e2e"),
+  use: { ...base.use, launchOptions: { args: ["--no-proxy-server", "--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE localhost, EXCLUDE 127.0.0.1"] } },
+  webServer: (base.webServer as Array<Record<string, unknown>>).map(server => ({
+    ...server, cwd: process.cwd(), env: {
+      ...(server.env as Record<string, string>),
+      Auth__GoogleClientId: "", Auth__MicrosoftClientId: "", Email__Enabled: "false",
+      Ai__BaseUrl: "http://127.0.0.1:1", Stripe__SecretKey: "", Backups__Enabled: "false",
+      Workers__AiOperationsEnabled: "false", Workers__RulesEnabled: "false", Workers__FollowUpRemindersEnabled: "false",
+      Workers__DailyExportEnabled: "false", Workers__JobEnrichmentEnabled: "false"
+    }
+  }))
+};