feat(phase-6): implement production hardening, security remediation, and open standards

[shashankch]

• Load persistent 2048-bit RSA PEM key pairs in JwtConfig with environment fallback
• Restrict CORS origins via configurable app.cors.allowed-origins across REST and WebSocket STOMP
• Inject configurable access and refresh token lifetimes into TokenService
• Enforce team membership authorization checks across TaskService to eliminate IDOR risks
• Implement AWS SDK v2 S3/MinIO client and presigner with pre-signed download URLs and resilient offline fallback
• Integrate vendor-neutral OpenTelemetry (OTel) distributed tracing via standard OTLP HTTP exporter
• Add Jaeger all-in-one OTel collector container to Docker Compose
• Export and validate static OpenAPI 3.1 YAML specification in docs/api/openapi.yaml with OpenApiExportTest
• Upgrade in-memory rate limiter fallback to Caffeine bounded LRU cache with TTL eviction
• Add connection and read timeouts to AI RestClient in PluggableAiProvider
• Add RFC 7807 409 Conflict handler for ObjectOptimisticLockingFailureException
• Add Hibernate @SQLRestriction for automatic soft-delete filtering on Task and TaskComment
• Set Java 25 bytecode release target and expand ArchUnit hexagonal boundary rules
• Create ADR 0006 (OpenTelemetry standard) and ADR 0007 (Free-tier pluggable infrastructure)
• Synchronize all documentation across roadmap, changelog, and tracking