docs(backlog): production + Web UI/UX audit issues (#332–#409)

.github/issue-drafts/01-e01-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Enforce identity-derived tenant access with zero cross-tenant leakage in adversarial tests.
+
+### Proposed solution
+
+Deliver C01–C03; success: adversarial suite shows no cross-tenant access.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E01 -->

.github/issue-drafts/02-e02-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Operable production queue without IDOR or stalled jobs.
+
+### Proposed solution
+
+Deliver C04–C06 (+ related queue tests/Helm worker); success: Compose/Helm queued scan completes safely.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E02 -->

.github/issue-drafts/03-e03-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+No browser-stored API secrets and no plaintext tenant integration secrets in DB.
+
+### Proposed solution
+
+Deliver C07–C08; success: no credentials in localStorage/build; secrets encrypted at rest.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E03 -->

.github/issue-drafts/04-e04-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Correct rate limits, dedup, and leases across replicas.
+
+### Proposed solution
+
+Deliver C09–C10; success: two-replica consistency tests pass.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E04 -->

.github/issue-drafts/05-e05-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Public probes leak no topology; detailed diagnostics are RBAC-protected.
+
+### Proposed solution
+
+Deliver C11–C12; success: anonymous health shows no infra detail.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E05 -->

.github/issue-drafts/06-e06-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Version-aware matching and bounded concurrent NVD retrieval.
+
+### Proposed solution
+
+Deliver C13–C14; success: version fixtures pass and latency improves.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E06 -->

.github/issue-drafts/07-e07-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Honest parse-vs-analysis messaging and hardened normalization.
+
+### Proposed solution
+
+Deliver C15–C16; success: UI/API distinguish parse-only from analysis.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E07 -->

.github/issue-drafts/08-e08-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Standards ingestion with conservative applicability evidence.
+
+### Proposed solution
+
+Deliver C17–C19; success: fixtures and provenance checks pass.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E08 -->

.github/issue-drafts/09-e09-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Durable finding snapshots and remediation trends.
+
+### Proposed solution
+
+Deliver C20–C21; success: users reopen and compare scans.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E09 -->

.github/issue-drafts/10-e10-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Extensible feeds without central switch edits; durable search.
+
+### Proposed solution
+
+Deliver C22–C24; success: fixture plugin needs no central dispatch edit.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E10 -->

.github/issue-drafts/11-e11-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Verifiable finding/report origin for operators and recipients.
+
+### Proposed solution
+
+Deliver C25–C26; success: offline signature verification docs and tooling work.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: E11 -->

.github/issue-drafts/12-e12-epic.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Reduce doc drift, bus factor, CI waste, and tribal ops knowledge.
+
+### Proposed solution
+
+Deliver C27–C30 (+ public ROADMAP/SUPPORT/good-first-issue curation); success: one test run/commit; ownership documented.
+
+### Area
+
+i18n / documentation
+
+---
+
+<!-- audit-id: E12 -->

.github/issue-drafts/13-c01-fail-closed-on-production-authentication.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Production can run without API-key or OIDC authentication, creating accidental public exposure. Operators and downstream users are affected. Priority P0; complexity M.
+
+### Proposed solution
+
+Validate configuration during startup and refuse production startup without an authentication mode. Permit only an explicit development override. Goals: secure defaults. Non-goals: changing IdPs. Acceptance: startup tests cover all modes; Docker/Helm/docs updated. Risk: breaking insecure installations. Dependency: none. Labels: `enhancement`, `security`, `breaking-change`. Milestone: M1. Estimate: 3–5 days. References: `server/middleware/apiAuth.ts`, `server/index.ts`.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C01 -->

.github/issue-drafts/14-c02-bind-tenant-context-to-authenticated-identity.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+`X-Tenant-Id` is caller-controlled and not constrained by API-key/OIDC identity. Priority P0; complexity L.
+
+### Proposed solution
+
+Add identity-to-tenant membership resolution; reject conflicting headers; audit denials. Acceptance: cross-tenant requests return indistinguishable 403/404; OIDC/API-key tests pass. Non-goal: tenant billing. Risk: migration for existing administrators. Dependency: C01. Labels: `security`, `tenancy`. Milestone M1. Estimate 1–2 weeks. Reference: `server/middleware/tenantContext.ts`.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C02 -->

.github/issue-drafts/15-c03-enforce-tenant-scope-at-repository-boundaries.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Tenant predicates are optional and distributed. A missed filter can disclose tenant data. P0/XL.
+
+### Proposed solution
+
+Require `TenantContext` in every tenant-owned repository method; use compound tenant/resource lookups; add negative tests. Acceptance: every foreign resource ID returns 404; static inventory complete. Dependency C02. Labels: `security`, `database`, `tenancy`. M1; 2–3 weeks. Alternatives: PostgreSQL RLS later.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C03 -->

.github/issue-drafts/16-c04-ship-production-worker-service.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Production Redis enables queued scans but no worker is deployed. P0/M.
+
+### Proposed solution
+
+Add Compose and Helm worker workloads using `server/worker/run.ts`; health, graceful shutdown and smoke test. Acceptance: submitted job reaches completion in production Compose. Dependency none. Labels: `jobs`, `deployment`. M2; 4–6 days. Reference: `docker-compose.prod.yml`.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C04 -->

.github/issue-drafts/17-c05-add-job-leasing-retries-and-idempotency.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Worker crashes can duplicate or strand effects. P1/L.
+
+### Proposed solution
+
+Define lease owner/expiry, retry classes, dead-letter status and idempotency keys. Acceptance: concurrent worker tests prove one effective result and bounded retries. Dependency C04. Labels: `jobs`, `reliability`. M2; 1–2 weeks.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C05 -->

.github/issue-drafts/18-c06-tenant-scope-job-apis-and-redis-keys.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Job status/results are fetched by global ID without ownership checks. P0/M.
+
+### Proposed solution
+
+Store tenant ownership, namespace keys and authorize status/results/cancel/progress. Acceptance: foreign IDs cannot be read; owner behavior remains compatible. Dependencies C02/C03. Labels: `security`, `jobs`. M1; 4–6 days. Reference: `server/handlers/jobHandlers.ts`.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C06 -->

.github/issue-drafts/19-c07-replace-browser-stored-credentials.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+OIDC and API credentials reside in localStorage or potentially bundles. P0/L.
+
+### Proposed solution
+
+Use HttpOnly Secure SameSite sessions and CSRF controls; prohibit production `VITE_API_KEY`; clear legacy keys. Acceptance: no token in browser storage/build; logout revokes session. Dependency C01. Labels: `security`, `frontend`. M1; 1–2 weeks.
+
+### Area
+
+UI / UX
+
+---
+
+<!-- audit-id: C07 -->

.github/issue-drafts/20-c08-encrypt-tenant-integration-secrets.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Notification secrets are plaintext JSONB. P0/L.
+
+### Proposed solution
+
+Use versioned AEAD envelope encryption with key IDs and rotation command. Acceptance: new and migrated secrets encrypted; logs/responses remain redacted. Dependency C03. Labels: `security`, `secrets`, `database`. M1; 1–2 weeks.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C08 -->

.github/issue-drafts/21-c09-define-shared-state-adapters.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Rate limits, dedup and operational state have incompatible process-local implementations. P1/L.
+
+### Proposed solution
+
+Create typed cache/counter/dedup/lease contracts with explicit fail-open/fail-closed behavior. Acceptance: complete state inventory and in-memory/Redis adapters. Labels: `architecture`, `scalability`. M2; 1–2 weeks.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C09 -->

.github/issue-drafts/22-c10-implement-atomic-redis-limits-and-dedup.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Multiple replicas multiply rate limits and notifications. P1/L.
+
+### Proposed solution
+
+Use atomic Redis operations/scripts, tenant/environment namespaces, expiry and outage metrics. Acceptance: two-process tests prove global quota and single-winner dedup. Dependency C09. M2; 1–2 weeks.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C10 -->

.github/issue-drafts/23-c11-split-liveness-readiness-startup-probes.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+One health route serves public and diagnostic purposes. P1/S.
+
+### Proposed solution
+
+Add minimal liveness, dependency-aware readiness and startup endpoints. Acceptance: liveness performs no dependencies; readiness uses bounded checks and status codes. Labels: `operations`, `health`. M1; 2–3 days.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C11 -->

.github/issue-drafts/24-c12-protect-detailed-diagnostics.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Detailed health exposes infrastructure/source state. P1/M.
+
+### Proposed solution
+
+Move details under RBAC-protected Ops API; redact URLs/errors; include worker freshness. Acceptance: anonymous access denied and audited. Dependencies C01/C04/C11. M2; 3–5 days.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C12 -->

.github/issue-drafts/25-c13-bounded-concurrent-nvd-retrieval.md

@@ -0,0 +1,15 @@
+### Problem or use case
+
+Sequential NVD work causes long scans and timeouts. P1/M.
+
+### Proposed solution
+
+Add shared token bucket, configurable concurrency, jitter/backoff and abort propagation. Acceptance: pagination remains complete and benchmark improves without exceeding quota. M2; 4–6 days.
+
+### Area
+
+API / backend
+
+---
+
+<!-- audit-id: C13 -->