sec(auth,credentials,oidc,secrets): remaining FOLD-1044 hardening (M1-M7, L1-L6, N4-N5) #1058

Report 03 (auth/OIDC/secrets/credentials review) remaining Medium/Low/Nit findings for PR #1044. See docs/code-review/16-remaining-findings-plan.md FOLD-1044.

Findings:

• 03-M1 (credentials/cipher.go): add len(key)==32 guard to Encrypt/Decrypt; prevent silent AES-128/192 downgrade
• 03-M2 (credentials/cipher.go): make multiple-key-env-var config a hard error
• 03-M3 (secrets/gcp_resolver.go): implement client-side HasPrefix in GCP ListSecrets to match interface doc
• 03-M5 (auth/service_password.go): rate-limit password reset requests per email
• 03-M6 (oidc/azure_signer.go): validate Azure public exponent fits int64 and is in range before conversion
• 03-M7 (oidc/factory.go): emit precise error when exactly one Azure OIDC env var is set
• 03-L1 (auth/service_password.go): mask domain in redactEmail
• 03-L2 (auth/service_apikeys.go): guard apiKey[:8] with len check
• 03-L3 (auth/service_password.go): rename containsSequentialChars to containsRepeatedChars
• 03-L4 (oidc/lambda_issuer.go, issuer_cache.go): validate URL is absolute https before caching as iss
• 03-L5 (auth/types.go): document IsUnrestrictedAccess fail-open default prominently
• 03-L6 (auth/service_group.go): document matchStringListConstraints empty-list semantics
• 03-N4 (auth/service_helpers.go): generateToken: encode raw bytes directly, drop pointless SHA-256
• 03-N5 (credentials/resolver.go): validate required fields non-empty after unmarshal