feat(casan): establish assurance kernel and harden control plane

docker-compose.control-panel.yml

@@ -3,9 +3,9 @@
 # `production-preflight.sh` validates all files, endpoints, Object Lock and
 # images before `docker compose up` is allowed.
 #
-# oauth2-proxy must emit X-Auth-Request-User and X-Auth-Request-Groups.
-# Nginx overwrites X-CASAN-* headers before proxying to the API; the API maps
-# groups such as casan-approver -> approver via rbac-check.py map-claim.
+# oauth2-proxy must emit a signed OIDC access token. Nginx removes caller-supplied
+# identity headers and forwards only that bearer token; the API verifies issuer,
+# audience, expiry and signature in-process before deriving CASAN identity.
 
 services:
   control-panel-api:
@@ -19,7 +19,6 @@ services:
     environment:
       CASAN_PROFILE: prod
       CASAN_CP_STRICT: "1"
-      CASAN_CP_TRUST_AUTH_PROXY: "1"
       CP_BIND: 0.0.0.0
       CP_PORT: "3010"
       CASAN_APP_ROOT: /app
@@ -29,6 +28,7 @@ services:
     volumes:
       - ${CASAN_CP_STATE_DIR:?Set CASAN_CP_STATE_DIR}:/app/.specify
       - ${CASAN_CP_OUTPUT_DIR:?Set CASAN_CP_OUTPUT_DIR}:/app/docs/output:ro
+      - ${CASAN_CP_IDP_PUBLIC_KEY:?Set CASAN_CP_IDP_PUBLIC_KEY}:/run/casan-idp/idp-public.pem:ro
     expose:
       - "3010"
     networks:
@@ -57,8 +57,8 @@ services:
       - --http-address=0.0.0.0:4180
       - --reverse-proxy=true
       - --set-xauthrequest=true
-      - --pass-access-token=false
-      - --pass-authorization-header=false
+      - --pass-access-token=true
+      - --pass-authorization-header=true
       - --skip-provider-button=true
       - --cookie-secure=true
       - --cookie-httponly=true