Complete IAM, audit attestation, and entitlement lease security slice

[BeforeLights]

Summary

• completes the IAM service-account security slice with scoped lifecycle management, one-time credentials, rotation, revocation, and Prisma persistence
• adds provider-neutral BUA entitlement leases with canonical payload signing, bounded verification, HMAC adapter, API routes, and durable persistence
• adds AUD seal attestation ports, immutable in-memory/Prisma adapters, signing and verification service, API routes, and traceability evidence
• updates migration and OpenAPI contract inventories for the new public surfaces

Validation

• corepack pnpm repo:check
• corepack pnpm repo:build
• corepack pnpm --filter @databreeze/api test (446 passing)
• corepack pnpm requirements:check

Notes

This PR is intentionally targeted at dev. Per repository policy, CodeRabbit is reserved for the subsequent promotion PR to main; no review is requested on this PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bb85f602-92b4-4d2b-b8f3-c0fe841e7fe7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}