feat(iios): wire the three-proof gate into the request path (§1b)

Applies the context-attestation verifier at the request boundary via a guard, so a
stolen/forged/replayed attestation is rejected before IIOS acts — while staying safe
to roll out.

- ContextAttestationGuard: if an X-Context-Attestation header is present, verify it
  (its app_id must match the actor token's app_id) → 403 on any failure; if absent,
  allow only when IIOS_REQUIRE_ATTESTATION != 1 (dev/zero-trust), else 403. The flag is
  read per-request and defaults OFF, so existing callers keep working until AppShell/
  be-crm start forwarding attestations.
- AttestationModule (@Global): provides the verifier + Prisma stores + guard, and
  dev-seeds the crm-support-widget client so locally minted attestations verify.
- Guard applied to ThreadsController + SupportController.
- Tests (5 pass, no DB): not-required-allows, required-rejects, valid, forged, replayed.

Workload/mTLS (proof #2) stays a mesh concern. Next: SDK header passthrough + demote
be-crm IiosClient to forward an attestation, then flip the flag to prove end-to-end.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/support/support.controller.ts

@@ -1,8 +1,9 @@
-import { BadRequestException, Body, Controller, Get, Headers, Param, Patch, Post, Query } from '@nestjs/common';
+import { BadRequestException, Body, Controller, Get, Headers, Param, Patch, Post, Query, UseGuards } from '@nestjs/common';
 import { IiosTicketState } from '@prisma/client';
 import { SupportService } from './support.service';
 import { AssignmentService } from './assignment.service';
 import { SessionVerifier } from '../platform/session.verifier';
+import { ContextAttestationGuard } from '../platform/context-attestation.guard';
 import type { MessagePrincipal } from '../identity/actor.resolver';
 import {
   AssignTicketDto,
@@ -15,6 +16,7 @@ import {
 } from './support.dto';
 
 @Controller('v1/support')
+@UseGuards(ContextAttestationGuard)
 export class SupportController {
   constructor(
     private readonly support: SupportService,