feat: fix critical gaps — security, audit logging, uploads, CI/CD

[rahuliitk]

Summary

Comprehensive gap-fix release addressing 12 issues found during deep audit of the codebase.

Security Fixes

• Org-level access control: Added VerifiedOrgId dependency to ALL org-scoped routes (20+ route files, 100+ endpoints). Previously, any authenticated user could access any org's data by changing the URL path parameter.
• Audit logging wired: log_audit() now called from all 40+ mutation endpoints (create/update/delete across controls, policies, risks, evidence, incidents, vendors, training, monitoring, integrations)

Backend Fixes

• Collector credentials: Fixed credentials=None hardcode in collection_service.py — now reads real credentials from Integration.credentials_ref
• Redis caching expanded: Added cache get/set/invalidate to risk_service and policy_service (joins existing control_service and framework_service)
• SMTP email: Real email sending via smtplib with TLS support; graceful fallback to logging when SMTP not configured
• Config: Added SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD, SMTP_FROM_EMAIL, SMTP_USE_TLS

Frontend Features

• Evidence file upload: Create evidence form + file upload button (multipart) + download button per evidence item
• Integration connect flow: Real credential input modal per provider (AWS, GitHub, Okta) with field-specific placeholders
• Public trust center: New /trust/[slug] route — public page with hero, certifications grid, documents, NDA section, contact
• API client: Added upload() method for multipart/form-data file uploads

Infrastructure

• GitHub Actions CI: 5 jobs — backend lint, backend test, frontend lint+typecheck, frontend build, docker build, security scan
• Makefile: 15 targets — dev, build, lint, format, test, migrate, seed, clean, logs, shell
• Pre-commit hooks: trailing whitespace, end-of-file, YAML/JSON check, merge conflict detection, private key detection, ruff lint+format
• Alembic migrations: Added 0000_phase1 base migration (was missing) + 0006_v05 for notifications/auditor/embeddings tables. Fixed migration chain.

Stats

• 41 files changed, 1,572 insertions, 248 deletions
• Version: 0.6.0

Test plan

• Verify org_id mismatch returns 403 Forbidden
• Verify audit logs are created for all CRUD operations
• Test evidence file upload and download flow
• Test integration connect modal for AWS/GitHub/Okta
• Visit /trust/{slug} for a published trust center
• Verify Redis cache invalidation on risk/policy mutations
• Run alembic upgrade head from clean DB
• Verify CI passes on PR

🤖 Generated with Claude Code