security: Sprint 00 — critical security fixes (OPC WS auth, Transmission creds, SECRET_KEY, passkey rate limit)

- Add JWT token auth to OPC WebSocket (unauthenticated → 403, per-user tracking)
- Externalize Transmission RPC credentials to TRANSMISSION_USER/PASS env vars
- Remove hardcoded SECRET_KEY fallback from dev compose
- Rate-limit passkey register options endpoint at 5/minute
- Add PDD (docs/improvement-plan.md) and sprint specs (specs/)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

dashboard/backend/routers/passkey.py

@@ -56,7 +56,8 @@ def _get_challenge(client_data_b64: str) -> bytes:
 
 
 @router.post("/passkey/register/options")
-async def passkey_register_options(current_user=Depends(auth.get_current_user)):
+@limiter.limit("5/minute")
+async def passkey_register_options(request: Request, current_user=Depends(auth.get_current_user)):
     """Generate WebAuthn registration options for adding a new passkey."""
     existing = auth.load_passkey_credentials()
     exclude = [PublicKeyCredentialDescriptor(id=base64url_to_bytes(c["credential_id"])) for c in existing]