CDS production RBAC hardening
Validated locally: backend Maven JDK17 tests pass; frontend Biome lint, Vitest and build pass. Temporary MR branch points at feat/rbac-prod-hardening-20260630 because the original branch was already up-to-date and SSH push-option would not create an MR from it.