refactor: remove obsolete resource download and installer endpoints

- Deleted the `POST /resources/get/{dataFolder?}` and `GET /resources/get-installer` endpoints as part of the architectural shift towards simplified resource management.
- Removed associated methods and configurations, including `ResourcesService.GetEncryptedResource`, `ResourcesService.GetInstaller`, and related properties in `ResourcesConfig`.
- Cleaned up environment variables and configuration files to reflect the removal of installer-related settings.
- Eliminated the `GetResourceRequest` DTO and its validator, along with the `WrongResourceName` error code.
- Updated documentation to clarify the changes in resource handling and the retirement of per-user file encryption.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_tasks/_dependencies_table.md

@@ -1,8 +1,8 @@
 # Dependencies Table
 
-**Date**: 2026-05-13 (refreshed; original 2026-04-16)
-**Total Tasks**: 11 (7 done test tasks + 4 active product tasks)
-**Total Complexity Points**: 40
+**Date**: 2026-05-14 (refreshed; previous 2026-05-13)
+**Total Tasks**: 19 (7 done test tasks + 12 active product tasks)
+**Total Complexity Points**: 71
 
 | Task   | Name                          | Complexity | Dependencies            | Epic   | Status |
 |--------|-------------------------------|-----------:|-------------------------|--------|--------|
@@ -17,9 +17,21 @@
 | AZ-196 | register_device_endpoint      | 2          | None                    | AZ-181 | todo   |
 | AZ-197 | remove_hardware_id            | 3          | None                    | AZ-181 | todo   |
 | AZ-513 | classes_crud_routes           | 3          | None                    | AZ-509 | todo   |
+| AZ-531 | refresh_token_flow            | 5          | None                    | AZ-529 | todo   |
+| AZ-532 | asymmetric_signing_jwks       | 5          | None                    | AZ-529 | todo   |
+| AZ-533 | mission_token_uav             | 5          | AZ-531                  | AZ-529 | todo   |
+| AZ-534 | totp_2fa_login                | 5          | None (coord. AZ-531/537) | AZ-529 | todo   |
+| AZ-535 | logout_revocation             | 3          | AZ-531                  | AZ-529 | todo   |
+| AZ-536 | argon2id_password_hashing     | 3          | None                    | AZ-530 | todo   |
+| AZ-537 | login_rate_limit_lockout      | 3          | None (coord. AZ-536)    | AZ-530 | todo   |
+| AZ-538 | cors_https_only_hsts          | 2          | None                    | AZ-530 | todo   |
 
 ## Notes
 
-- AZ-513 added 2026-05-13 (cross-workspace prerequisite from `ui/` workspace AZ-512). Filed under epic AZ-509 (Cycle 3 — Auth bootstrap fix + classColors carve-out + admin class edit).
+- **AZ-529 / AZ-530 added 2026-05-14**: two new epics covering the auth-mechanism modernization and a focused CMMC compliance pass.
+  - **AZ-529 — Auth Mechanism Modernization** (5 tasks, 23 pts): refresh-token flow, asymmetric signing + JWKS, mission tokens for UAV, TOTP 2FA, logout/revocation. AZ-531 is the foundation that AZ-533 and AZ-535 build on; AZ-532 is independent and can land first or in parallel.
+  - **AZ-530 — CMMC Compliance Hardening** (3 tasks, 8 pts): Argon2id password hashing, /login rate limit + lockout, CORS https-only + HSTS. All three are independent and shippable now; AZ-536 + AZ-537 both touch `UserService.ValidateUser` so land AZ-536 first.
+- **MFA scope**: TOTP enrollment + login validation lives in admin only (AZ-534). Other services (satellite-provider, gps-denied, ui) consume the `amr` claim if they need step-up checks — they do NOT enforce MFA themselves.
+- **Cross-workspace verifier work** (satellite-provider, gps-denied, ui must switch from HS256 shared secret to JWKS verification, plus add denylist polling) is intentionally **deferred** to per-workspace tickets, to be filed once admin's AZ-529 epic is close to shipping.
+- AZ-513 added 2026-05-13 (cross-workspace prerequisite from `ui/` workspace AZ-512). Filed under epic AZ-509.
 - AZ-197 originally listed `Component: Admin API, Loader`; the Loader workspace was architecturally retired (see `suite/_docs/_repo-config.yaml` `unresolved:loader-retirement-arch-doc`) and the spec was adapted on 2026-05-13 to be admin-only.
-- All four active tasks (AZ-183, AZ-196, AZ-197, AZ-513) are independent — no inter-task dependencies in this active set.