security: fix 6 vulnerabilities identified in SDLC audit

- fix(auth): enforce API key scopes in require_role/require_any_role;
  attach _api_key_scopes to user on API key auth; add require_scope()
  dependency — scopes were stored but never enforced (CWE-285)

- fix(sso): read SECURE_COOKIES env var for SSO cookie instead of
  hardcoded secure=False — SAML sessions now respect HTTPS config (CWE-614)

- fix(webhooks): SSRF prevention — validate webhook URLs against private
  and reserved CIDRs at creation/update time (CWE-918)

- fix(knowledge): restrict playbook/lesson create, update and restore
  to admin/red_lead/blue_lead roles — was open to any authenticated user (CWE-284)

- fix(alerts): restrict alert acknowledge/resolve/dismiss to admin/lead
  roles — any user could silence security alerts (CWE-284)

- security: delete get_admin_creds.py, check_auth.py, deploy.py scripts
  containing hardcoded root SSH credentials and production DB access;
  add scripts/.gitignore to prevent reintroduction (CWE-798)

backend/app/routers/knowledge.py

@@ -42,7 +42,7 @@ def list_playbooks(
 def create_playbook(
     body: PlaybookCreate,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     return pb_svc.create_playbook(db, body.model_dump(), user.id)
 
@@ -61,7 +61,7 @@ def update_playbook(
     playbook_id: UUID,
     body: PlaybookUpdate,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     return pb_svc.update_playbook(db, playbook_id, body.model_dump(exclude_unset=True), user.id)
 
@@ -91,7 +91,7 @@ def restore_version(
     playbook_id: UUID,
     version: int,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     """Roll the playbook back to a specific historical version."""
     return pb_svc.restore_version(db, playbook_id, version, user.id)
@@ -159,7 +159,7 @@ def list_lessons(
 def create_lesson(
     body: LessonLearnedCreate,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     return ll_svc.create_lesson_learned(db, body.model_dump(), user.id)
 
@@ -178,7 +178,7 @@ def update_lesson(
     lesson_id: UUID,
     body: LessonLearnedUpdate,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     return ll_svc.update_lesson_learned(
         db, lesson_id, body.model_dump(exclude_unset=True), user.id