fix: ADR-080 P0 security + CI remediation from QE analysis

Address all 5 P0 issues from QE analysis (55/100 score):

- P0-1: Rate limiter bypass — validate X-Forwarded-For against trusted proxy list
- P0-2: Exception detail leak — generic 500 messages, exception_type gated by dev mode
- P0-3: WebSocket JWT in URL (CWE-598) — first-message auth pattern replaces query param
- P0-4: Rust tests not in CI — add rust-tests job gating docker-build and notify
- P0-5: WebSocket path mismatch — use WS_PATH constant instead of hardcoded /ws/sensing

Includes ADR-080 remediation plan and 9 QE reports (4,914 lines).
Firmware validated on ESP32-S3 (COM8): CSI collecting, calibration OK.

Co-Authored-By: claude-flow <ruv@ruv.net>

.github/workflows/ci.yml

@@ -62,6 +62,32 @@ jobs:
           bandit-report.json
           safety-report.json
 
+  # Rust Workspace Tests
+  rust-tests:
+    name: Rust Workspace Tests
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Install Rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+
+    - name: Cache cargo
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+          rust-port/wifi-densepose-rs/target
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rust-port/wifi-densepose-rs/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-
+
+    - name: Run Rust tests
+      working-directory: rust-port/wifi-densepose-rs
+      run: cargo test --workspace --no-default-features
+
   # Unit and Integration Tests
   test:
     name: Tests
@@ -183,7 +209,7 @@ jobs:
   docker-build:
     name: Docker Build & Test
     runs-on: ubuntu-latest
-    needs: [code-quality, test]
+    needs: [code-quality, test, rust-tests]
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
@@ -282,7 +308,7 @@ jobs:
   notify:
     name: Notify
     runs-on: ubuntu-latest
-    needs: [code-quality, test, performance-test, docker-build, docs]
+    needs: [code-quality, test, rust-tests, performance-test, docker-build, docs]
     if: always()
     steps:
     - name: Notify Slack on success