fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

job-tracker-ui/playwright.rate-limits.config.ts

@@ -0,0 +1,24 @@
+import { defineConfig } from "@playwright/test";
+import base from "./playwright.config";
+
+// Real API/auth middleware, fresh synthetic SQLite data, no external providers.
+const backend = (base.webServer as Array<{ env: Record<string, string>; command: string }>)[0];
+export default defineConfig({
+  testDir: "./rate-limit-tests", workers: 1, retries: 0, timeout: 60_000,
+  webServer: {
+    ...backend,
+    reuseExistingServer: false,
+    env: {
+      ...backend.env,
+      RateLimits__AuthLoginPermitLimit: "10",
+      AccountLifecycle__DeletionEnabled: "false",
+      // Only this fixture's loopback proxy may supply client addresses. Other loopback
+      // source addresses exercise untrusted direct ingress without external networking.
+      Proxy__TrustForwardedHeaders: "true", Proxy__KnownNetworks__0: "127.0.0.1/32",
+      Auth__GoogleClientId: "", Auth__MicrosoftClientId: "", Email__Enabled: "false",
+      Ai__BaseUrl: "http://127.0.0.1:1", Stripe__SecretKey: "", Backups__Enabled: "false",
+      Workers__AiOperationsEnabled: "false", Workers__RulesEnabled: "false",
+      Workers__FollowUpRemindersEnabled: "false", Workers__DailyExportEnabled: "false", Workers__JobEnrichmentEnabled: "false",
+    },
+  },
+});