fix(security): tier-0 audit blockers (next CVE, role gate, perm traps, key validation, rate limits)

Closes the five highest-risk findings from
docs/audit-comprehensive-2026-05-05.md so the platform is not exposed
while the rest of the audit backlog (1 CRIT + 18 HIGH + 32 MED + 23 LOW)
is worked through:

* CVE-2025-29927 — bump next 15.1.0 → 15.2.9; nginx strips
  X-Middleware-Subrequest at the edge as defense-in-depth.
* Cross-tenant role escalation — POST/PATCH/DELETE on /admin/roles now
  require super-admin (was: any holder of admin.manage_users).  Adds
  shared `requireSuperAdmin(ctx)` helper.
* Silent-403 traps — `documents.edit` and `files.edit` keys added to
  RolePermissions; seeded role values updated; migration 0041 backfills
  the new keys on every existing roles+port_role_overrides JSONB.  File
  routes remap the dead `create` action to `upload` / `manage_folders`.
* Berth-PDF / brochure register endpoints — reject body.storageKey
  unless it matches the namespace the matching presign endpoint issued
  (prevents repointing a tenant's PDF at foreign-port bytes).
* Portal auth rate limits — sign-in 5/15min/(ip,email),
  forgot-password 3/hr/IP, activate/reset/set-password 10/hr/IP.  Adds
  `enforcePublicRateLimit()` for non-`withAuth` routes.

Test status unchanged: 1168/1168 vitest, tsc clean.

Refs: docs/audit-comprehensive-2026-05-05.md (CRITICAL, HIGH §§1–4)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/rate-limit.ts

@@ -91,6 +91,17 @@ export const rateLimiters = {
    *  without dropping data. The shared-secret header gates abuse; this
    *  limiter is just a defensive backstop in case the secret leaks. */
   websiteIntake: { windowMs: 60 * 60 * 1000, max: 500, keyPrefix: 'websiteintake' },
+  /** Portal sign-in: 5 attempts per 15min per (ip,email) bucket. Defends
+   *  against credential stuffing on /api/portal/auth/sign-in. */
+  portalSignIn: { windowMs: 15 * 60 * 1000, max: 5, keyPrefix: 'portal:signin' },
+  /** Portal forgot-password: 3/hour/IP. Tighter than sign-in because it
+   *  triggers an outbound email and is the primary email-enumeration
+   *  vector (timing differences between known/unknown). */
+  portalForgot: { windowMs: 60 * 60 * 1000, max: 3, keyPrefix: 'portal:forgot' },
+  /** Portal activate / reset / set-password: 10/hour/IP. Bounds brute-
+   *  force against the 32-byte token (random walk math is in our favour
+   *  but a tight ceiling keeps the search space practically infeasible). */
+  portalToken: { windowMs: 60 * 60 * 1000, max: 10, keyPrefix: 'portal:token' },
 } as const satisfies Record<string, RateLimitConfig>;
 
 export type RateLimiterName = keyof typeof rateLimiters;