fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

job-tracker-ui/playwright.ingress.config.ts

@@ -0,0 +1,12 @@
+import { defineConfig } from "@playwright/test";
+import rateLimits from "./playwright.rate-limits.config";
+
+const backend = rateLimits.webServer as { env: Record<string, string>; command: string };
+const env = { ...backend.env, ASPNETCORE_ENVIRONMENT: "Production", App__PublicBaseUrl: "https://jobs.example.test" };
+delete (env as Record<string, string>).Cors__Origins__0; // Exercise the real production CORS default.
+
+export default defineConfig({
+  testDir: "./ingress-tests", workers: 1, retries: 0,
+  // dotnet run's launch profile otherwise overrides ASPNETCORE_ENVIRONMENT with Development.
+  webServer: { ...backend, command: backend.command.replace(" run ", " run --no-launch-profile "), env },
+});