fix(wab): bind verified identities to account operations

[ty-everett]

Summary

• bind every Shamir share read, write, update, and deletion to the user that owns the externally verified authentication identity
• remove the legacy production OTP bypass and canonicalize Twilio identities as E.164 phone numbers
• prevent authentication identities from moving between live users while preserving faucet-abuse history for deliberately deleted accounts
• replace forgeable deletion-key prefixes with persistent, hashed, expiring, rate-limited, single-use sessions bound to the exact method, identity, and user
• validate public controller inputs, including exact 256-bit identifiers and bounded SDK Shamir-share envelopes
• document the security invariants and advance the private WAB server/image candidate to 1.4.11

Why

The extended CodeQL review identified several validation guards for manual inspection. That review uncovered real authorization gaps: a valid OTP for one phone could be presented alongside another user's Shamir hash, deletion accepted any string with the expected prefix, a hard-coded historical phone/OTP pair bypassed Twilio, and an existing authentication identity could be reassigned to another live account.

This change makes the externally verified identity, stored user, and requested target agree before any sensitive operation. Deletion intents are now durable across service instances and resistant to forgery, replay, cross-flow reuse, and database growth.

Public-service compatibility

WAB remains a public protocol service. This PR does not narrow its public-by-default, credential-free wildcard CORS behavior. Operators retain the existing exact-origin allowlist and disabled modes. CSP remains an application/document policy rather than API authorization.

Validation

• npm test -- --runInBand — 10 suites, 86 tests passed
• npm run test:coverage -- --runInBand — 67.47% statements overall; request validation 98.44%, deletion sessions 88.37%
• npm run build
• npm run lint
• npm audit --audit-level=moderate — 0 vulnerabilities
• pnpm audit --audit-level=high — no known vulnerabilities
• pnpm health:check — 37 projects, 0 control errors
• pnpm check-versions
• node scripts/check-sdk-peer.mjs

Tracks #324.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud