Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

Critical: Add ownership checks to all order routes (IDOR fix).
High: Redis rate limiting on auth endpoints, HMAC-signed internal
service calls replacing header-presence-only checks, nh3 HTML
sanitization on ghost_sync and product import, internal auth on
market API endpoints, SHA-256 hashed OAuth grant/code tokens.
Medium: SECRET_KEY production guard, AP signature enforcement,
is_admin param removal, cart_sid validation, SSRF protection on
remote actor fetch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/infrastructure/activitypub.py

@@ -328,9 +328,10 @@ def create_activitypub_blueprint(app_name: str) -> Blueprint:
 
         if not sig_valid:
             log.warning(
-                "Unverified inbox POST from %s (%s) on %s — accepting anyway for now",
+                "Unverified inbox POST from %s (%s) on %s — rejecting",
                 from_actor_url, activity_type, domain,
             )
+            abort(401, "Invalid or missing HTTP signature")
 
         # Load actor row for DB operations
         actor_row = (