sec: fix C4/C5/M4/M5 + domain migration to syntrex.pro

C4: Remove localhost:9100 fallback from 27 dashboard files (use relative URLs)
C5: JWT token_type differentiation (access vs refresh) - middleware rejects refresh as Bearer
M4: Server-side registration gate via SOC_REGISTRATION_OPEN env var
M5: HTML tag stripping on name/org_name fields (XSS prevention)

Domain migration:
- users.go: admin@syntrex.pro
- zerotrust.go: SPIFFE trust domain
- sbom.go: namespace URL
- .env.production.example: all URLs updated
- identity_test.go: test email

internal/infrastructure/auth/users.go

@@ -64,11 +64,11 @@ func NewUserStore(db ...*sql.DB) *UserStore {
 	}
 
 	// Ensure default admin exists
-	if _, err := s.GetByEmail("admin@xn--80akacl3adqr.xn--p1acf"); err != nil {
+	if _, err := s.GetByEmail("admin@syntrex.pro"); err != nil {
 		hash, _ := bcrypt.GenerateFromPassword([]byte("syntrex-admin-2026"), bcrypt.DefaultCost)
 		admin := &User{
 			ID:            generateID("usr"),
-			Email:         "admin@xn--80akacl3adqr.xn--p1acf",
+			Email:         "admin@syntrex.pro",
 			DisplayName:   "Administrator",
 			Role:          "admin",
 			Active:        true,