security: fail-closed defaults for prod auth + Twilio sig

[dougdevitre]

Summary

Three production-safety changes from a security pass. Each mirrors the existing fail-closed pattern in api/cron/cost-rollup.ts.

• Twilio signature validation forced on in production (src/core/twiml.ts) — signatureValidationEnabled() now returns true when NODE_ENV=production regardless of VALIDATE_TWILIO_SIGNATURE. Previously the env var defaulted to "false", so any deploy that didn't explicitly set it to "true" accepted forged Twilio webhooks → spoofed call status, arbitrary TwiML, and amplified Anthropic + ElevenLabs cost.
• Outbound + records auth fail-closed in prod (src/core/outbound.ts, src/core/records.ts) — when both OUTBOUND_API_KEY and CLERK_SECRET_KEY are unset and NODE_ENV=production, return 500 "Server misconfigured" instead of falling open. A misconfigured prod deploy was previously a direct path to billing fraud (/call/outbound) or PII leak (/records). Non-prod still falls open as a local-dev escape hatch.
• RECORDS_TTL_DAYS NaN guard (src/config/env.ts) — parseFloat("abc") was propagating NaN into DynamoDB TTL timestamps; now falls back to 365.

Test plan

• npm run typecheck — clean
• npm test — 284/286 (same 2 pre-existing failures on main, not introduced here)
• Verify NODE_ENV=production with VALIDATE_TWILIO_SIGNATURE unset → /call/incoming rejects unsigned POSTs with 403
• Verify NODE_ENV=production with both auth env vars unset → /call/outbound returns 500 with { error: "Server misconfigured" }
• Verify NODE_ENV=development with both auth env vars unset → still falls open (no behavior change)

🤖 Generated with Claude Code

[dougdevitre]

Manual verification — code trace ✅

All three remaining test-plan items verified by tracing the code paths:

• NODE_ENV=production + VALIDATE_TWILIO_SIGNATURE unset → signatureValidationEnabled() returns true unconditionally (twiml.ts:37), unsigned POST → 403 (api/call/incoming.ts:54-56)
• NODE_ENV=production + both auth vars unset → 500 "Server misconfigured" in both outbound.ts:146-164 and records.ts:64-79
• NODE_ENV=development + both auth vars unset → skips prod guard, returns null → falls open (no behavior change)

CI green (284/286, same 2 pre-existing on main). Merging.