Initial import with GitLab CI/CD and registry deploy flow

docs/security/checklist.md

@@ -0,0 +1,24 @@
+# Security Checklist (Stage 4)
+
+## Scope
+- MVP on-prem deployment baseline
+- API gateway + service-level RBAC
+- Data persistence and backup handling
+
+## Checklist
+- [x] RBAC enforced on privileged endpoints (`auth/users`, `routing/queues`, `knowledge/categories`)
+- [x] Role-denied requests return `403` without side effects
+- [x] Request payload validation enabled via Pydantic models
+- [x] SQL access uses parameterized ORM operations (SQLAlchemy)
+- [x] Health and registry endpoints do not expose secrets
+- [x] Backup archives created and restored via controlled scripts
+- [x] Security smoke checks automated in `scripts/gate4_check.py`
+
+## Verification Commands
+- `python scripts/gate4_check.py`
+- Optional artifact retention: `python scripts/gate4_check.py --keep-artifacts`
+
+## Out of Scope for MVP
+- LDAP/SSO integration
+- External secrets manager integration
+- WAF and SIEM integration