fix: secure gateway bootstrap and conversation binding

[vessenes]

What changed

• require a dedicated bearer secret for POST /v1/promote
• make the TypeScript client and AIM browser send the configured operator token during promotion
• keep the AIM promotion token ephemeral: password input, no local-storage persistence, cleared after success
• validate canonical 32-byte conversation keys and a non-negative safe-integer epoch
• reject idempotent bootstrap retries whose crypto material differs from durable state
• require every gate and governance message conv_id to match the durable conversation
• store vote bodies and make scanners fail closed on legacy/bodyless or cross-conversation votes
• configure the promotion token in deploy automation, docs, and the local integration harness

Why

The public bootstrap endpoint was first-writer-wins and unauthenticated. Separately, signed requests and votes could be replayed into another durable conversation because handlers verified their embedded conv_id without comparing it to trusted state.

The original security fix also broke AIM promotion because the browser had no authenticated bootstrap path. This revision adds that path without persisting the operator secret.

Deployment requirement

Create the QNTM_GATEWAY_PROMOTION_TOKEN GitHub Actions secret before merging. The workflow installs it as the GATEWAY_PROMOTION_TOKEN Worker secret.

Validation

• gateway worker: 66 tests and typecheck
• client: 191 tests, build, and publish tarball verification
• AIM UI: 49 tests and production build
• model integration: 24 tests
• downstream PR Add cross-surface UI acceptance gate #22: 13/13 real-service browser/CLI/TUI/gateway/relay scenarios
• Proofshot: required/disabled token state and masked ready state; 0 console/server errors

Stack

This PR targets PR #16. PR #17 and PR #22 are stacked above it so #22 tests the exact combined security tree.