sprint: S09.5 done — dev deploy runs on nas runner (was vps); all exit criteria verified and marked complete

specs/sprint-09-security-hardening.md

@@ -61,7 +61,7 @@
 - **Verify by:**
   1. Push to dev → deploy step runs on NAS runner, not VPS.
 
-- [ ] S09.5 — Fix dev deploy runner label
+- [x] S09.5 — Fix dev deploy runner label
 
 ## S09.6 — Add `media-ops` to RBAC member defaults
 
@@ -78,11 +78,11 @@
 
 ## Exit criteria
 
-- [ ] No hardcoded SECRET_KEY fallback in any compose file
-- [ ] Audit log gated to admin only
-- [ ] Dev CI gates deploy behind tests
-- [ ] Dev CI deploys on NAS runner
-- [ ] `media-ops` accessible to members
-- [ ] All 267+ backend tests pass
-- [ ] All frontend tests pass
-- [ ] `npm run build` succeeds
+- [x] No hardcoded SECRET_KEY fallback in any compose file
+- [x] Audit log gated to admin only
+- [x] Dev CI gates deploy behind tests
+- [x] Dev CI deploys on NAS runner
+- [x] `media-ops` accessible to members
+- [x] All 267+ backend tests pass
+- [x] All frontend tests pass
+- [x] `npm run build` succeeds