Harden the production RFQ host boundary

[0xMuang]

Stacked dependency

Depends on #84 (feature/rfq-durable-coordinator). This PR is intentionally based on feature/rfq-durable-coordinator, not main.

Scope

• Adds a production-boundary RFQ host package that fails closed before quote coordination when auth, request size, rate limit, freshness, signer verification, or audit/incident hooks are unsafe.
• Binds authenticated taker identity to quote requests and keeps audit/metrics PII-free by hashing principals, idempotency keys, and signer/error refs.
• Extends RFQ coordinator evidence with freshness metadata, local signer verification, reserved recovery handling, and strict freshness enforcement hooks.
• Updates RFQ policy, threat model, security/testing docs, FEATURES, PROGRESS, QUALITY, and scripts/check.sh to include the production host while keeping the local demo backend unchanged.

Tests / validation

• npm test --prefix services/rfq — passes.
• npm test --prefix services/rfq-host — passes.
• npm test --prefix services/rfq-demo-backend — passes.
• npm test --prefix services/testnet-rfq-demo — passes.
• Hostile auth/rate/freshness/signer/audit/reserved-recovery cases are covered in the new host/RFQ smoke tests.
• git diff --cached --check — clean before commit.
• Staged secret/scratch scan completed; fake test token is covered by an audit no-leak assertion. Existing untracked contracts.md, deployments/, and desc.md were preserved and not staged.

Known blocker / not tested

• scripts/check.sh remains blocked by pre-existing forge fmt drift in script/DeployProductionCore.s.sol and script/DemoScenarios.s.sol.
• Full E2E was skipped in this integration step to preserve existing untracked deployments/ artifacts.

Production replacements required

This PR keeps reference implementations intentionally narrow. Production deployment must replace:

• reference bearer auth with operator auth / mTLS or equivalent identity boundary,
• in-memory limiter with shared rate limiting,
• file-backed RFQ store with transactional HA database storage,
• local HTTP assumptions with TLS termination and hardened ingress,
• local audit callback with WORM/SIEM-backed audit and incident processing.

No merge into main is requested here.