feat(security): complete P0 release blocking remediation

Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.

scripts/backfill_task_run_projection.go

@@ -36,7 +36,11 @@ func main() {
 		log.Fatal(err)
 	}
 
-	svc := bizdev.NewService(cfg)
+	svc, err := bizdev.NewService(cfg)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "NewService: %v\n", err)
+		os.Exit(1)
+	}
 	srv := server.NewServer(cfg, svc)
 	ctx := context.Background()