security(teams): bind board tokens to one space

[rakeshutekar]

Summary

• Bind every board token to exactly one opaque board space.
• Enforce that scope centrally across all /v1/board routes.
• Project remote journal reads, cases, counts, and writes to the token's space.
• Require scoped CLI tokens and validate MCP space configuration.
• Safely retire tokens during board-space rekeys.

Security behavior

• Wrong-space requests return the same generic 404 whether the target exists or not.
• Legacy unscoped, wildcard, system-role, and malformed tokens fail closed.
• /spaces exposes only the token's bound space.
• Rejected requests cannot mutate board, journal, policy, cursor, or attachment state.
• Token registry changes are serialized across processes.
• Board and journal rekeys use one coordinated SQLite transaction.
• Rekey tombstones prevent stale or newly minted credentials from recreating the old space.
• In-flight requests are serialized against rekeys.

Migration

Existing tokens without a space claim will stop authenticating and must be re-minted:

ocw board token mint --actor <actor> --role <role> --space <space>

Tokens scoped to a space that is rekeyed must also be re-minted for the new space.

Trusted in-process journal callers retain the existing cross-board case behavior. Remote credentials receive a space-specific projection.

Testing

• 156 affected tests pass.
• Includes coverage for every board route, journal isolation, malformed registries, legacy tokens, MCP/CLI behavior, rollback, and startup recovery.
• Deterministic cross-process registry race test passes.
• Independent security review found no remaining Critical, Important, or Minor findings.
• git diff --check and Python compilation pass.

Dependencies

Depends on #585 and #586 and should land after them.

Out of scope

The remaining board object-route authorization consistency audit will be handled separately.