Release v0.27.0: security hardening (audit 0026)

Remediates the rfc-app application + deploy-config findings from the
Session 0026 security audit. Cut as the "v0.25.0-security-hardening"
branch (from v0.24.0); reversioned to 0.27.0 on rebase onto main since
v0.26.0 (#28) shipped while this was in flight.

- C1 (Critical): single sanitizeHtml.js chokepoint (DOMPurify) for every
  marked→innerHTML / dangerouslySetInnerHTML sink (MarkdownPreview,
  ProposalView x2, Editor); rel=noopener hook on target=_blank links.
- H1: per-account OTC-verify lockout (migration 023, auto-applied) +
  per-IP throttle via new ratelimit.py; wired on otc verify/request +
  passcode check/verify.
- M1: device_trust.lookup() single indexed-row read — cookie value is now
  "<row_id>.<raw_token>"; bcrypt-checks one row, not a global table scan.
  (Behavior change: existing device-trust cookies re-prompt once.)
- M2: HTTP security headers (CSP/HSTS/XFO/XCTO/Referrer-Policy) at nginx.
- M4: session cookie Secure-by-default (SESSION_COOKIE_SECURE opt-out).
- M5: bounce webhook fails CLOSED (503) when secret unset, instead of open;
  RFC_APP_INSECURE_BOUNCE_WEBHOOK=1 dev opt-in.
- L2/L3: per-IP cooldown + check-endpoint throttle.
- L4: systemd sandbox knobs. L8/I1: nginx server_tokens off + TLS1.0/1.1 out.

VERSION + frontend/package.json → 0.27.0; CHANGELOG documents the upgrade
steps (incl. the out-of-band nginx + systemd apply, which the flotilla
deploy gesture does not perform).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/migrations/023_otc_verify_lockout.sql

@@ -0,0 +1,18 @@
+-- v0.25.0 / security audit 0026, finding H1.
+--
+-- The OTC verify path had no attempt-limit or lockout, unlike the
+-- passcode path (015_passcode.sql gave users.passcode_failed_attempts +
+-- passcode_locked_until). This table gives the OTC verify endpoint the
+-- same per-identity lockout shape. It is keyed by email rather than
+-- user_id because an OTC sign-in may not have a users row yet — the row
+-- is provisioned only on a *successful* verify, so the lockout state has
+-- to survive independently of it.
+--
+-- The per-IP rate limiter (app/ratelimit.py) is the primary brute-force
+-- defense; this table is the parity layer that mirrors the passcode
+-- lockout and persists across restarts.
+CREATE TABLE IF NOT EXISTS otc_verify_state (
+    email TEXT PRIMARY KEY,
+    failed_attempts INTEGER NOT NULL DEFAULT 0,
+    locked_until TEXT
+);