fix(gateway)!: replace token cookies with revocable sessions and harden abuse controls

- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests.
- Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401.
- Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion.
- Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning.
- Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base.
- Update manifests, production checklist, architecture/security docs and add an SSO preflight script.

BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.

examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml

@@ -131,6 +131,24 @@ spec:
             # a private PVC), so trade DSH's inner file policy for a working
             # agent. Set this to workspace-write (or read-only) on hosts where a
             # backend is available; see the README troubleshooting row.
+            # SECURITY: the pod is the isolation boundary in this example.
+            # danger-full-access is set only because DSH's own command sandbox
+            # has no usable backend in this pod (see above), which means an
+            # agent command can read its own DSH_HOME (including
+            # .credentials.yaml) and write anywhere in the container. What
+            # still contains it is the pod itself: one pod per user, non-root,
+            # all capabilities dropped, RuntimeDefault seccomp, its own PVC and
+            # Service. That is NOT a hardened multi-tenant boundary on a shared
+            # kernel. For production/multi-tenant use, additionally run the
+            # sandbox under gVisor (`runtimeClassName: gvisor` above) so a
+            # container escape is trapped in a userspace kernel, and apply the
+            # sandbox NetworkPolicy (manifests/optional/network-policy/) so
+            # tenants cannot reach each other or cluster-internal endpoints.
+            # The base manifests without those two controls are a demo. Treat
+            # danger-full-access as a fallback, not a target: on hosts where
+            # DSH's command-sandbox backend works, prefer workspace-write (or
+            # read-only), and recreate the pod because the value is stamped at
+            # creation.
             - name: DSH_PERMISSION_MODE
               value: danger-full-access
           # Probes target /favicon.svg: DSH gates / behind its launch-token