P0 security batch: admin-only user mgmt, unified role model, login rate limiting, webhook secret, security headers, pagination caps

- Remove POST /api/auth/register (404); no sign-up UI; users are admin-managed
- Add admin-only POST/PATCH/DELETE /api/auth/users (forced canonical roles,
  self-lockout + reference guards)
- Unify role model in app/core/roles.py; reject unknown roles at creation and
  at login/JWT validation; startup normalizes unambiguous legacy aliases
- Login rate limiting ~5 fails/15 min per IP+email -> 429 (in-process, tunable)
- WhatsApp webhook requires X-Webhook-Secret; fail-closed when env unset;
  GET handshake uses constant-time verify token (403 on mismatch)
- GET /api/whatsapp/mock-log now requires auth
- Security headers middleware: X-Frame-Options DENY, nosniff, CSP on HTML,
  HSTS behind TLS
- Pagination: limit alias for page_size, hard cap enforced, both -> 422

.env.example

@@ -13,3 +13,14 @@ WHATSAPP_PHONE_NUMBER_ID=
 WHATSAPP_ACCESS_TOKEN=
 WHATSAPP_VERIFY_TOKEN=
 META_GRAPH_BASE=https://graph.facebook.com/v18.0
+
+# ── Webhook auth (P0) ──────────────────────────────────
+# Shared secret for inbound WhatsApp webhook POSTs (X-Webhook-Secret header).
+# FAIL-CLOSED: when unset/empty, every webhook message is rejected (403).
+# Generate with: openssl rand -hex 32
+WHATSAPP_WEBHOOK_SECRET=
+
+# ── Login rate limiting (P0) ────────────────────────────
+# ~5 failed login attempts per 15 minutes per IP+email → HTTP 429
+LOGIN_RATE_LIMIT_MAX_ATTEMPTS=5
+LOGIN_RATE_LIMIT_WINDOW_SECONDS=900