promote: foundation and IAM completion

[BeforeLights]

Promotion scope

Promotes the reviewed foundation/IAM batch from dev to main after feature PR #24 merged successfully.

Included: durable IAM credentials and sessions, personal organization bootstrap, memberships, MFA lifecycle, audit persistence and reads, provider-independent entitlements and usage reads, live tenant context, browser CSRF and secure refresh cookies, current-session identity, OpenAPI regeneration, strict lint/format gates, and CI verification.

Verification

• Feature PR Foundation and IAM completion #24 merged to dev with merge commit 86f25c8
• API suite: 184 passing tests
• Root tests, lint, typecheck, orchestration, requirements, contracts, infrastructure, Android, Python, security, and repository checks passed on the feature PR
• OpenTofu remains unavailable locally; static infrastructure checks pass and CI covers repository validation

Review policy

This is the single promotion PR designated for CodeRabbit. Please perform one full review on this PR only; no CodeRabbit review was requested on the dev feature PR.

Summary by CodeRabbit

• New Features

  • Added session inspection, refresh, sign-out, MFA, recovery-code, PKCE, and CSRF protections.
  • Added artifact admission, uploads, exports, retention, lineage, inbox triage, and protected-document unlock workflows.
  • Added governed dataset versions, profiles, quality results, exports, publishing, compatibility checks, entitlements, audit, and spreadsheet-audit capabilities.

• Bug Fixes

  • Improved tenant isolation, revision conflict handling, immutable records, sensitive-data redaction, and fail-closed security behavior.

• Documentation

  • Added execution plans, handoff procedures, rollback guidance, and resumable delivery tracking.

• Tests

  • Expanded coverage across security, persistence, APIs, tenant isolation, datasets, artifacts, and audit workflows.

[BeforeLights]

Superseded because the accumulated dev-to-main diff reached 181 commits and 281 changed files, beyond the repository's review limits. Promotion will continue through four first-parent slices (33, 75, 36, and 37 commits); no further CodeRabbit invocation should occur on this PR.