Fix the flaky suite and triage the CodeQL baseline

[Bccorb]

Pre-release work on #190 and #208. Two commits, each green on its own (typecheck
plus full suite verified at each SHA).

Rebased. This PR originally carried a third commit adopting
@seamless-auth/types 0.15.0. main moved during the work and 40e17ca
already does that, better: it extracts an authenticatorPolicyService, warns
at startup when an allow list is set without attestation: 'direct', and
refuses an authenticator that declines to identify itself rather than admitting
it. My duplicate has been dropped and this is rebased onto it. See the note at
the bottom about the dependent survey, which still applies.

test: fix the flaky suite, closes #190

Three leaks, none of them about parallelism, which is why running one file at a
time never helped and why the sequential coverage run flaked too.

1. clearAllMocks does not drain the Once queue. Only mockReset clears
   onceMockImplementations. Every spec's beforeEach called clearAllMocks,
   so a queued mockResolvedValueOnce the code path never consumed survived into
   a later test and shifted every subsequent queued value by a place.
   organizations.spec.ts queues 22. That accounts for the full symptom range,
   including the 20s timeout: a call expecting a queued value got undefined and
   awaited something that never settled.
2. Fire-and-forget handlers bleeding across the test boundary. Handlers
   answer the request and then finish void AuthEventService.log(...), so
   supertest resolved with continuations still queued; one landing mid-next-test
   breaks a toHaveBeenCalledTimes. Drained in a global afterEach. The void
   in the handlers is deliberate and untouched.
3. Stubs are process state. vi.stubEnv / vi.stubGlobal write to
   process.env and globalThis, which isolate does not roll back between
   files. Nothing in the tree ever called vi.unstubAllGlobals.

Verified: 20 consecutive runs in each mode, re-run after the rebase. main
before this failed 3 of 20 sequential runs.

Side effect: fileParallelism is back on and the suite went from 12.9s to
2.1s. npm run coverage no longer forces sequential either.

Two tests were passing only because of the leak and are fixed rather than
deleted, most notably user.spec.ts > returns 404 when no user, which never
simulated a missing user and asserted expect([200, 404]).toContain(res.status).

One residual is tracked separately in #214: a rare 20s timeout under coverage,
one occurrence in ~57 runs, with a different signature (a handler that cannot
hang on its own logic, so it looks like worker starvation rather than ordering).

fix(security): CodeQL baseline, refs #208

The baseline had grown to 25 alerts, not the 10 in the issue. All are now
resolved: 8 fixed here, 16 dismissed with written reasons on the issue, 1
escalated.

Fixed:

• redaction.ts built its output on a plain object, so a __proto__ key in
  untrusted audit metadata hit the prototype setter: the key vanished from the
  redacted output unredacted and replaced that object's prototype with
  caller-supplied content. Now built on a null prototype.
• file-system-race ×2, worse than "dev only" suggested. Both did
  check-then-write, so two processes starting together could both pass the check,
  both generate and both write, leaving one signing with a key that was neither
  on disk nor published in JWKS. Both now create exclusively and adopt the
  winner's key on losing the race.
• log-injection ×5, fixed centrally in the winston format rather than at
  five call sites, since untrusted values reach log messages through template
  strings across the codebase and one missed interpolation reopens it.

Escalated to #213: passkeyAvailable is read straight from the POST /login
body, and sending false skips the passkey-only branch and gets the caller
offered email OTP instead. That defeats passkey_login_fallback_enabled: false,
which is the one setting whose job is to prevent exactly that. It overlaps #177
and needs a product decision, so it is not folded in here.

Notable dismissals, with the reasoning on the issue: the four
insufficient-password-hash alerts are HMAC over OAuth state and PKCE material
rather than passwords; eight of the nine user-controlled-bypass alerts fail
closed or are an admin list filter; the polynomial-redos alert is unreachable
because the preceding collapse leaves no two dashes adjacent (measured flat at
10k/40k/80k dashes, and the invariant is now a comment since it depends on the
order of the two replaces).

The five log-injection alerts may reappear on the next scan, because the
escaping sits in the winston format rather than on the taint path CodeQL follows.
If so they should be dismissed on the same footing as clear-text-logging, not
"fixed" by scattering sanitiser calls across every call site.

Dependent survey for the syncedPasskeys breaking change

Carried out for the duplicate commit, and it applies unchanged to 40e17ca now
on main, so recording it here rather than losing it.

403 synced_passkey_not_allowed and 403 authenticator_not_allowed are new
responses on POST /webAuthn/register/finish, and authenticator_policy gained
three fields.

Repo	Impact
seamless-auth-server	None. readPassthroughFailure forwards the body verbatim, so the code and status arrive intact.
seamless-auth-react	Breaks the UX. extractMessage uses { error } as the message, so the user sees the literal synced_passkey_not_allowed. fells-code/seamless-auth-react#132
seamless-auth-admin-dashboard	No authenticator_policy UI at all, so the new default cannot be changed from the console. fells-code/seamless-auth-admin-dashboard#238
seamless-auth-docs	New fields and refusal codes undocumented, as is the existing prf_required. fells-code/seamless-auth-docs#41
seamless-cli, seamless-templates	No coupling found.

Worth weighing before the release: with syncedPasskeys defaulting to block,
a default deployment refuses every iCloud Keychain and Google Password Manager
passkey, and the React SDK currently renders the raw code as the user-facing
message. The two SDK issues above are what make that recoverable.

Checks

npm run typecheck, npm run lint, npm run format:check and npm run build
all pass. Full suite green at 1054 tests.

Two changesets included.