fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

job-tracker-ui/e2e/smoke.spec.ts

@@ -50,7 +50,9 @@ async function login(page: Page) {
 async function csrfHeader(page: Page) {
   const cookie = (await page.context().cookies()).find((value) => value.name === "XSRF-TOKEN");
   expect(cookie, "login should issue a CSRF cookie").toBeTruthy();
-  return { "X-CSRF-TOKEN": cookie!.value };
+  const me = await (await page.request.get(`${apiUrl}/auth/me`)).json();
+  expect(me.sessionContext).toBeTruthy();
+  return { "X-CSRF-TOKEN": cookie!.value, "X-Session-Context": me.sessionContext };
 }
 
 test.beforeEach(async ({ page }) => {
@@ -401,6 +403,8 @@ test("a public CV renders anonymously and downloads as PDF", async ({ page }, te
   expect(publish.ok()).toBeTruthy();
   const published = await publish.json();
 
+  // Stop the signed-in page before removing cookies; B02 correctly redirects a live session.
+  await page.goto("about:blank");
   await page.context().clearCookies();
   await page.setViewportSize({ width: 375, height: 900 });
   await page.goto(`/cv/${published.publicSlug}`);