fix: remediate production security review findings

[jomplox]

Summary

• gate real Wompi link creation on production fiscal readiness, reject production mock mode, and validate hosted-link origins
• add account-wide progressive login MFA plus bounded, atomic provider-creation budgets
• reject conflicting Wompi replays and sanitize MH responses before logs, observations, and durable storage
• require exact retention manifests with an independent D1 authenticity anchor
• tighten account-audit authorization, include donor PDF artifacts in the private-boundary guard, and emit production HSTS

Security findings addressed

1. Validate fiscal readiness before creating a real Wompi link.
2. Fail closed when mock mode is configured in production.
3. Scan tmp/pdfs in the required private-boundary guard.
4. Require bounded step-up MFA after distributed account login failures.
5. Distinguish equivalent Wompi replays from conflicting identifier collisions.
6. Bound and sanitize MH provider errors and credential echoes before every sink.
7. Verify the exact backup table set against a live D1 authenticity anchor.
8. Add atomic global, provider, and normalized-client creation budgets.
9. Restrict account-scoped audit queries to ADMIN and OWNER.
10. Emit one-year HSTS on all production Worker and static responses.
11. Accept only approved HTTPS Wompi checkout hosts and paths.

The final integrated review also hardened the exact TEST fallback-auth endpoint, persisted MH token type as constant Bearer, covered numeric credential echoes, and added one bounded retry for unattached Stripe-claim cleanup.

Verification

• full suite: 144 files passed; 2,698 tests passed; 2 skipped
• final focused security batch: 479 passed; 1 skipped
• mounted login-MFA Playwright flow: 1 passed
• production build and worker typechecks passed
• historical migrations 0001-0047 are immutable
• private artifact boundary passed
• git diff --check passed
• final whole-branch fix re-review: all findings addressed; no new Critical, Important, or Minor breakage
• regression guards were mutation-proven before restoration

Deployment boundary

• This PR does not deploy or mutate Cloudflare, MH, Wompi, Stripe, D1, R2, queues, routes, WAF, or Bot Management state.
• HSTS intentionally omits includeSubDomains and preload until sibling-subdomain HTTPS readiness is reviewed.
• The repository-level provider budgets are enforced in D1; live edge bot controls remain a separate deployment task.
• The private-boundary forbidden-host inventory is not configured, so that optional host check is inactive. No locally available OpenAI Privacy Filter was present, so no model-scan result is claimed.
• Live provider behavior, deployed D1 contention, and deployed log redaction remain for separately authorized staging verification.