feat(Phase-5.5): Security hardening and audit fixes

[chitrank2050]

Overview

This is the tracking issue for Phase 5.5. The goal is to fix all security vulnerabilities and technical debt identified in the security audit before production deployment. This is not a feature phase — it's a quality gate.

Every item here was identified in the Meterplex Security & Technical Audit Report v2 (2026-05-20). Critical items (1-4) are pre-production blockers. Medium items (5-11) improve correctness and maintainability. No new features — only fixes.

Success Criteria

• No cross-tenant mutation possible via param/header mismatch
• Users can only update their own profile (or admin updates within their tenant)
• Platform catalog mutations (plans, features, entitlements, prices) restricted to platform admins
• Rate limiting enforced on all public endpoints (auth, usage ingestion, invoice generation)
• Refresh token lookup handles purged tokens gracefully
• Subscription cancel properly transitions status to CANCELLED
• consume() endpoint persists usage events through the pipeline (no billing gap)
• Audit log sanitization handles nested objects recursively
• Audit log payload size capped to prevent OOM
• All hardcoded enum strings replaced with Prisma enum references
• Billing ledger restricted to OWNER/ADMIN/BILLING roles
• Invoice controller delegates to service layer (no Prisma in controller)
• process.env.PORT replaced with ConfigService
• Subscription history and API keys endpoints paginated

Tracking / Sub-tasks

• fix(security): tenant :id param vs x-tenant-id header mismatch #140
• fix(security): user update endpoint allows any user to modify any profile #141
• feat(security): add PlatformAdminGuard for catalog mutations #142
• feat(security): implement rate limiting with Redis sliding window #143
• fix(auth): refresh token findFirstOrThrow fails open on purged tokens #144
• fix(subscriptions): cancel endpoint doesn't update status to CANCELLED #145
• fix(entitlements): consume endpoint doesn't persist usage events #146
• fix(audit): recursive sanitization + size limits in audit log interceptor #147
• fix(billing): add RolesGuard to billing ledger endpoints #148
• fix(invoices): refactor controller to delegate to service layer #149
• fix(misc): process.env.PORT, pagination, duplicate comment #150
• docs(phase-5.5): security audit resolution log #151
• fix(quality): replace all hardcoded enum strings with Prisma enum references #152

Resources

• Security Audit Report: docs/audits/security-audit-v2.md
• Architecture Log: docs/phases/phase-5.5.md (to be created)

Why this phase matters

The audit identified 3 critical security vulnerabilities that allow cross-tenant data mutation, unauthorized user modification, and catalog corruption by any registered user. These are pre-production blockers — deploying without fixing them means any user can compromise any tenant.

Rate limiting is equally critical — without it, brute-force attacks on auth, usage flooding, and billing DoS are trivial.

This phase exists to close every known gap before Meterplex is production-grade.

Note: This issue represents the "Phase 5.5" milestone. Individual PRs should reference the specific sub-tasks above.