rebuild: ADR-0019..0025 + PQC ESM migration + P0 CORS/auth security fixes

[HeadyMe]

Summary

Consolidates architectural decision records (ADR-0019 through ADR-0025), PQC ESM migration, and Phase 1 P0 security fixes from the rebuild branch.

---

New ADRs

ADR	Title	Strength
0019	Nine-domain brand architecture — nonprofit/commercial IRS split	⭐⭐⭐⭐⭐
0020	Drupal 11 as headless CMS	⭐⭐⭐⭐
0022	GCP region canonical lock — us-east1, blocks heady-prod-609590223909	⭐⭐⭐⭐⭐
0023	heady-manager.js decomposition mandate	⭐⭐⭐⭐⭐
0024	src/config/domain-registry.js canonical domain file	⭐⭐⭐⭐⭐
0025	content-gateway Cloudflare Worker contract	⭐⭐⭐⭐

---

P0 Security Fixes (ADR-0023 Phase 1)

src/middleware/auth.js

heady-manager.js:399 — timing attack

- if (adminToken !== process.env.ADMIN_TOKEN) {
+ // crypto.timingSafeEqual with padding — constant-time comparison
+ if (!timingSafeStringEqual(provided, expected)) {

heady-manager.js:458/465 — tier derivation timing leak

- const tier = token === process.env.HEADY_API_KEY ? 'admin' : 'core'
+ const tier = resolveAuthTier(token, authEngine) // timingSafeEqual fallback

src/middleware/cors.js

heady-manager.js:197 — CORS wildcard

- origin: process.env.ALLOWED_ORIGINS?.split(',') ?? '*'
+ // Origin not in DOMAIN_REGISTRY → 403 CORS_ORIGIN_REJECTED
+ if (!isAllowedOrigin(origin)) return res.status(403).json(...)

---

New Source Files

File	Purpose
src/config/domain-registry.js	Canonical 9-domain registry with frozen enums, CORS set, Firebase tenant map, PQC namespace util
src/middleware/auth.js	P0 timing-safe auth middleware with tier resolution
src/middleware/cors.js	P0 DOMAIN_REGISTRY-driven CORS, 403 on unknown origin
src/security/pqc.js	ESM migration v2.0.0, private class fields, ML-KEM-768/ML-DSA-65
src/routes/pqc.js	ESM migration, export default router

---

Breaking Change

ALLOWED_ORIGINS env var is deprecated. Remove from all environments after merge — src/middleware/cors.js uses DOMAIN_REGISTRY exclusively.

---

Checklist

• No require() in any new file (ADR-0011)
• No magic numbers — phi-scaled constants only (ADR-0006)
• CORS wildcard removed (ADR-0023 P0)
• Timing-safe token comparison (ADR-0023 P0)
• headyconnection.org commercial: false in registry (ADR-0019 IRS)
• Unit tests for timing-safe auth (follow-up)
• Unit tests for CORS rejection (follow-up)