sec: fix C4/C5/M4/M5 + domain migration to syntrex.pro

C4: Remove localhost:9100 fallback from 27 dashboard files (use relative URLs)
C5: JWT token_type differentiation (access vs refresh) - middleware rejects refresh as Bearer
M4: Server-side registration gate via SOC_REGISTRATION_OPEN env var
M5: HTML tag stripping on name/org_name fields (XSS prevention)

Domain migration:
- users.go: admin@syntrex.pro
- zerotrust.go: SPIFFE trust domain
- sbom.go: namespace URL
- .env.production.example: all URLs updated
- identity_test.go: test email

internal/domain/identity/identity_test.go

@@ -119,7 +119,7 @@ func TestStoreRegisterAndGet(t *testing.T) {
 	agent := &AgentIdentity{
 		AgentID:   "agent-01",
 		AgentName: "Task Manager",
-		CreatedBy: "admin@xn--80akacl3adqr.xn--p1acf",
+		CreatedBy: "admin@syntrex.pro",
 		AgentType: AgentSupervised,
 	}
 	if err := s.Register(agent); err != nil {