security: fix 6 vulnerabilities identified in SDLC audit

- fix(auth): enforce API key scopes in require_role/require_any_role;
  attach _api_key_scopes to user on API key auth; add require_scope()
  dependency — scopes were stored but never enforced (CWE-285)

- fix(sso): read SECURE_COOKIES env var for SSO cookie instead of
  hardcoded secure=False — SAML sessions now respect HTTPS config (CWE-614)

- fix(webhooks): SSRF prevention — validate webhook URLs against private
  and reserved CIDRs at creation/update time (CWE-918)

- fix(knowledge): restrict playbook/lesson create, update and restore
  to admin/red_lead/blue_lead roles — was open to any authenticated user (CWE-284)

- fix(alerts): restrict alert acknowledge/resolve/dismiss to admin/lead
  roles — any user could silence security alerts (CWE-284)

- security: delete get_admin_creds.py, check_auth.py, deploy.py scripts
  containing hardcoded root SSH credentials and production DB access;
  add scripts/.gitignore to prevent reintroduction (CWE-798)

backend/app/routers/sso.py

@@ -1,5 +1,7 @@
 """Phase 14: SSO / SAML 2.0 router."""
 
+import os
+
 from fastapi import APIRouter, Depends, HTTPException, Request, Response, status
 from fastapi.responses import RedirectResponse
 from sqlalchemy.orm import Session
@@ -15,7 +17,19 @@ import app.services.sso_service as svc
 router = APIRouter(prefix="/sso", tags=["SSO"])
 
 _COOKIE_NAME = "aegis_token"
-_COOKIE_OPTS = {"httponly": True, "samesite": "lax", "secure": False}
+
+# Mirror the same SECURE_COOKIES logic used in the auth router so that
+# SAML-authenticated sessions respect the deployment's HTTPS configuration.
+_aegis_env = os.environ.get("AEGIS_ENV", "development").lower()
+_secure_cookie_env = os.environ.get("SECURE_COOKIES", "auto").lower()
+if _secure_cookie_env == "false":
+    _IS_HTTPS = False
+elif _secure_cookie_env == "true":
+    _IS_HTTPS = True
+else:  # "auto" — active only when AEGIS_ENV=production
+    _IS_HTTPS = _aegis_env == "production"
+
+_COOKIE_OPTS = {"httponly": True, "samesite": "lax", "secure": _IS_HTTPS}
 
 
 # ── Public ────────────────────────────────────────────────────────────────────