feat(web): add ct-cve service token boundary

[simonjcarr]

Summary

• add CT-CVE signed service-token verification with content hashes, HMAC signatures, timestamp skew checks, nonce replay protection, org binding, scopes, revocation, and env-based token parsing
• add signed CT Ops connection-health endpoint for CT-CVE with per-token rate limiting
• document CT_CVE_SERVICE_TOKENS and mark Phase 9 in progress in the migration plan

Validation

• node --experimental-strip-types --test lib/integrations/ct-cve/service-token.test.mjs
• pnpm --dir apps/web exec eslint lib/integrations/ct-cve/service-token.ts lib/integrations/ct-cve/service-token.test.mjs app/api/integrations/ct-cve/v1/connection-health/route.ts
• pnpm --dir apps/web type-check
• pnpm --dir apps/web db:validate
• pnpm --dir apps/web test:unit