security: fix 6 vulnerabilities identified in SDLC audit

- fix(auth): enforce API key scopes in require_role/require_any_role;
  attach _api_key_scopes to user on API key auth; add require_scope()
  dependency — scopes were stored but never enforced (CWE-285)

- fix(sso): read SECURE_COOKIES env var for SSO cookie instead of
  hardcoded secure=False — SAML sessions now respect HTTPS config (CWE-614)

- fix(webhooks): SSRF prevention — validate webhook URLs against private
  and reserved CIDRs at creation/update time (CWE-918)

- fix(knowledge): restrict playbook/lesson create, update and restore
  to admin/red_lead/blue_lead roles — was open to any authenticated user (CWE-284)

- fix(alerts): restrict alert acknowledge/resolve/dismiss to admin/lead
  roles — any user could silence security alerts (CWE-284)

- security: delete get_admin_creds.py, check_auth.py, deploy.py scripts
  containing hardcoded root SSH credentials and production DB access;
  add scripts/.gitignore to prevent reintroduction (CWE-798)

backend/app/routers/operational_alerts.py

@@ -88,9 +88,9 @@ def get_alert(
 def acknowledge_alert(
     alert_id: UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
-    """Acknowledge an open alert."""
+    """Acknowledge an open alert (admin / lead roles only)."""
     return svc.acknowledge(db, alert_id, current_user.id)
 
 
@@ -98,9 +98,9 @@ def acknowledge_alert(
 def resolve_alert(
     alert_id: UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
-    """Mark an alert as resolved."""
+    """Mark an alert as resolved (admin / lead roles only)."""
     return svc.resolve(db, alert_id, current_user.id)
 
 
@@ -108,9 +108,9 @@ def resolve_alert(
 def dismiss_alert(
     alert_id: UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
-    """Dismiss an alert (won't re-fire until cooldown resets)."""
+    """Dismiss an alert (admin / lead roles only — won't re-fire until cooldown resets)."""
     return svc.dismiss(db, alert_id, current_user.id)