v0.7 CAD lane: deploy proxy and rotate CAD backend secrets

[SheetMetalConnect]

Linear: ERY-12
Related dependency path: ERY-41, ERY-52
Planning source: work/ERY-346-v0.7-execution-breakdown.md

Objective

• Close the deploy and security dependency path for the v0.7 CAD lane.

Scope

• Deploy the hardened server-side CAD proxy revision.
• Rotate CAD backend credentials so browser-exposed values are invalidated.
• Remove any remaining active legacy CAD secret values from the frontend/runtime path.
• Record a non-secret verification artifact that the proxy is the only live path.

Acceptance criteria

• Proxy deployment evidence is recorded.
• CAD backend credentials are rotated without exposing secret material.
• Frontend build/runtime no longer ships or forwards CAD backend secrets.
• A follow-up CAD processing ticket can proceed without a secret-exposure blocker.