fix: resolve issues #398-#401 — security hardening

[darkcode123456]

#398 — Vulnerability allowlist expiry policy

• Add expiry date requirements to .cargo/audit.toml allowlist entries
• Create scripts/check_allowlist_expiry.py to parse audit.toml/deny.toml and fail the build when any entry is past its expiry date
• Add allowlist-expiry-check CI job to .github/workflows/security.yml
• Document review cadence, responsible owners, and current allowlist table in docs/vulnerability-scanning.md

#399 — ACL permission inheritance tests

• Add 6 inheritance/resolution-order tests to backend/src/acl.rs: explicit_deny_overrides_inherited_wildcard_allow, wildcard_deny_overrides_specific_subject_allow, two_level_inheritance_deny_beats_allow_at_every_level, role_with_no_assigned_rules_defaults_to_allow, three_level_wildcard_deny_blocks_all_principals, removing_inherited_deny_restores_access_for_all_principals
• Document ACL resolution order in docs/security.md with flow diagram and implications table

#400 — Multi-sig threshold change timelock

• Add MULTISIG_THRESHOLD_TIMELOCK constant (24 h) to lib.rs
• Add PendingThresholdChange struct and PendingMultiSigThreshold DataKey to types.rs
• Add 3 event topic constants (ms_t_prp / ms_t_app / ms_t_can)
• Implement propose_multisig_threshold / apply_multisig_threshold / cancel_multisig_threshold / get_pending_multisig_threshold functions
• Add ContractError variants 127-129 (ThresholdChangePending, ThresholdChangeTimeLocked, NoPendingThresholdChange)
• Add multisig_threshold_timelock_tests.rs with 10 tests covering timelock enforcement and cancellation paths
• Document the propose→wait→apply flow in docs/multi-sig.md

#401 — Push notification payload sanitization

• Add sanitize_notif_field(), remove_html_tags(), truncate_to_byte_len() helpers to backend/src/notifications.rs
• Apply sanitization to vault_id and passkey_hash in notification_content()
• Add NOTIF_FIELD_MAX_LEN constant (128 bytes)
• Add 14 tests covering HTML injection, control-character stripping, javascript: URIs, oversized payloads, UTF-8 truncation, and regression tests for previously vulnerable vault_id and passkey_hash fields
• Document sanitization policy in docs/push-notifications.md

closes #398
closes #399
closes #400
closes #401

[drips-wave]

@darkcode123456 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits