M0 security hardening: fix all vulnerabilities and resolve build errors

- Fix 5 source files corrupted with markdown formatting by previous AI
- Remove secret logging from auth middleware, signup, and recovery handlers
- Add role validation (ALLOWED_ROLES allowlist) to all 10 data_api + storage handlers
- Fix JavaScript injection in Deno runtime via double-serialization
- Add UUID validation to TUS upload paths to prevent path traversal
- Gate token issuance on email confirmation (AUTH_AUTO_CONFIRM env var)
- Reject unconfirmed users on login with 403
- Prevent OAuth account takeover (409 on email conflict with different provider)
- Replace permissive CORS (allow_origin Any) with ALLOWED_ORIGINS env var
- Wire session-based admin auth into control plane, add POST /platform/v1/login
- Hide secrets from list_projects API via ProjectSummary struct
- Add missing deps (redis, uuid, chrono, tower-http fs feature)
- Fix http version mismatch between reqwest 0.11 and axum 0.7 in proxy
- Clean up all unused imports across workspace

Build: zero errors, zero warnings. Tests: 10 passed, 0 failed.
Made-with: Cursor

gateway/src/main.rs

@@ -119,15 +119,18 @@ async fn main() -> anyhow::Result<()> {
         config: config.clone(),
     };
 
-    let control_state = control_plane::ControlPlaneState { db: pool.clone() };
-
     // Initialize Tenant Database (for Realtime)
     let default_tenant_db_url = std::env::var("DEFAULT_TENANT_DB_URL")
         .expect("DEFAULT_TENANT_DB_URL must be set");
-    tracing::info!("Connecting to default tenant database at {}...", default_tenant_db_url);
+    tracing::info!("Connecting to default tenant database...");
     let tenant_pool = wait_for_db(&default_tenant_db_url).await;
     tracing::info!("Tenant Database connected successfully.");
 
+    let control_state = control_plane::ControlPlaneState {
+        db: pool.clone(),
+        tenant_db: tenant_pool.clone(),
+    };
+
     let mut tenant_config = config.clone();
     tenant_config.database_url = default_tenant_db_url;