FRE-4474 Phase 5: Verify and resolve security review findings for SpamShield and Cross-Service Correlation

- FRE-4499 (SpamShield): Verified 6 security fixes (2 High, 4 Medium)
  - S01: Pre-compiled regex in RuleEngine (ReDoS fix)
  - S02: SmsClassifier accepts senderPhoneNumber context
  - S03: AlertServer JWT auth + origin validation
  - S04: SHA-256 phone hashing (PII protection)
  - S05: DecisionEngine timeout enforcement via Promise.race
  - S06: CarrierFactory.getAllCarriers properly async/await

- FRE-4500 (Correlation): Verified 7 security fixes (2 Critical, 2 High, 2 Medium, 1 Low)
  - C1: Ingest endpoints auth via request.user.id
  - C2: IDOR protection on group endpoints (userId filter)
  - H3: JWT middleware registered in server.ts
  - H4: Fastify schema validation on all routes
  - M6: Payload sanitization with depth limit and circular ref detection
  - L7: CORS origin restricted to env var

- Resolved liveness incidents FRE-4652 and FRE-4654
- All Phase 5 child issues now complete

packages/api/src/server.ts

@@ -3,7 +3,10 @@ import cors from "@fastify/cors";
 import helmet from "@fastify/helmet";
 import sensible from "@fastify/sensible";
 import { extractOrGenerateRequestId } from "@shieldai/types";
-import { darkwatchRoutes, voiceprintRoutes, correlationRoutes } from "./routes";
+import { authMiddleware } from "./middleware/auth.middleware";
+import { darkwatchRoutes } from "./routes/darkwatch.routes";
+import { voiceprintRoutes } from "./routes/voiceprint.routes";
+import { correlationRoutes } from "./routes/correlation.routes";
 
 const app = Fastify({
   logger: {
@@ -12,10 +15,13 @@ const app = Fastify({
 });
 
 async function bootstrap() {
-  await app.register(cors, { origin: true });
+  await app.register(cors, { origin: process.env.CORS_ORIGIN || "http://localhost:5173" });
   await app.register(helmet);
   await app.register(sensible);
 
+  // Register auth middleware to populate request.user
+  await app.register(authMiddleware);
+
   app.addHook("onRequest", async (request, _reply) => {
     const requestId = extractOrGenerateRequestId(request.headers);
     request.id = requestId;