fix(security): enforce RBAC and close five denial-of-service vectors

test(api): add Phase 0-1 suite with 59 tests at 93 percent coverage