epic: security hardening + receiver verify

[williamdewitt]

Epic — decompose into ready issues before pickup.

Security hardening + receiver verification.

• Non-bypassable SSRF guard (HTTPS-only, IP filtering, connect-time anti-rebinding, no-redirect, policy seam).
• Outbound payload cap + response-read cap; TLS-on.
• Secret-at-rest via host IDataProtectionProvider.
• Receiver WebhookVerifier (UC-6) + timestamp replay protection.

Risk: critical — every sub-issue is security-sensitive and needs a linked design update.

[williamdewitt]

Decomposed into agent-sized slices (2026-06-28) — all risk:critical (human-merge + linked design update), filed in milestone M3 — Security hardening + receiver verify:

• #70 — non-bypassable SSRF guard (M3a) → #71 — outbound/response caps + TLS-on (M3b)
• #72 — secret-at-rest via IDataProtectionProvider (M3c)
• #73 — receiver WebhookVerifier + replay protection (M3d) — the helper WebhookSink S4 (feat(sink): signature panel — HMAC + timestamp freshness (S4) #67) swaps to

Deliberately not agent-labelled: security work is built under supervision. Add agent to a slice when you want the scheduled loop to pick it up (it still won't auto-merge — risk:critical is always human-gated).