feat(casan): establish assurance kernel and harden control plane

infra/production/README.md

@@ -12,8 +12,10 @@ not be invented or committed.
    it at `/opt/casan-control-panel/tls/tls.crt` and `tls.key` (mode `0600`).
 2. Register `https://<fqdn>/oauth2/callback` with the enterprise IdP. Map the
    `groups` claim to CASAN groups such as `casan-org-admin` and
-   `casan-approver`. Copy `oauth2-proxy.env.example` outside the repo and fill
-   it using the secret manager.
+   `casan-approver`. Export the IdP's RS256 verification public key to
+   `/opt/casan-control-panel/idp-public.pem`; rotation requires replacing this
+   file and restarting the API. Copy `oauth2-proxy.env.example` outside the
+   repo and fill it using the secret manager.
 3. Create a Vault Transit key `casan-audit-key` with `exportable=false`; give a
    workload identity only `transit/sign/casan-audit-key` and read-key metadata.
    Render a short-lived token into `vault.env` outside Git. Never use Vault dev
@@ -35,6 +37,7 @@ sudo install -d -m 0700 /opt/casan-control-panel/tls /srv/casan/state /srv/casan
 sudo install -m 0600 /dev/null /opt/casan-control-panel/oauth2-proxy.env
 sudo install -m 0600 /dev/null /opt/casan-control-panel/runtime.env
 sudo install -m 0600 /dev/null /opt/casan-control-panel/vault.env
+sudo install -m 0644 /secure/export/idp-public.pem /opt/casan-control-panel/idp-public.pem
 
 bash packages/casan-harness/scripts/bash/production-preflight.sh infra/production/casan-prod.env
 set -a; source infra/production/casan-prod.env; set +a
@@ -43,9 +46,15 @@ docker compose -f docker-compose.control-panel.yml up -d
 
 The preflight performs a real Object Lock anchor write. It will reject local
 URLs, image tags, expired/near-expiry TLS, dev/root Vault tokens, incomplete
-OIDC, missing paths, and buckets without Object Lock. After login, run
+OIDC, issuer/audience mismatches, missing IdP keys, local trust providers,
+missing paths, and buckets without Object Lock. After login, run
 `managed-prod-smoke.sh` with an authenticated cookie jar.
 
+The API does not trust `X-CASAN-*` or forwarded-user headers from Nginx.
+oauth2-proxy returns the signed access token, Nginx removes caller-supplied
+identity headers, and the API verifies RS256 signature, issuer, audience,
+expiry and clock bounds before deriving actor, role, tenant and project.
+
 ## Operational anchors
 
 Run `audit-ship-s3.sh` after every audit seal from the same workload identity.