Security hardening, and delivery that ships less

Cendia 0.1.0 shipped the model. This release goes over it looking for the places where the model was right and the enforcement was missing.

• Access rights are enforced where they previously were not. Media reads — listing, detail, download and thumbnails — along with Delivery's block and media endpoints, the preview API and the trash listing now all check read access. They answer 404 rather than 403, so they do not confirm that a hidden item exists. If something was reachable by GUID that permissions did not cover, it no longer is.
• A preview signing key is required outside Development. The old well-known default let anyone mint a preview token and read unpublished content. A host now refuses to start without a real key, at startup and with the setting named — not as an error somebody finds later.
• Delivery no longer trusts supplied roles by default. The /_/roles/{csv} segment is trust, not authentication, and it is now off unless you turn it on. This is the one that needs action — see the upgrade notes.
• Stronger sign-in. Passwords need twelve characters across four character classes, accounts lock for five minutes after five failed attempts, and the login form is rate-limited per address. Existing passwords keep working. The forms now state the rule before you type rather than after.
• MCP is Administrator-only. Its tools act on content without a per-item permission check, so it is a privileged capability rather than a default one.
• Responses are compressed — Brotli with a gzip fallback, static files included.
• Fewer queries per page. Listing a page's children used to walk the ancestor chain once per child. It now resolves them together, in one query per level of ancestry, so the cost follows the depth of the tree rather than the number of items on the page.