feat: address the review on the split-deployment branch by moving the two broker routes onto their own NODE_BROKER_TOKEN so the internet-facing tracking and forms services no longer hold a credential that can open any organization's data key, refusing to presign any key outside the prefixes a node reaches, fixing IAM policies that named an alias ARN KMS never resolves in a Resource element, bounding both brokered HTTP clients because the sync loop's context never expires, no longer reporting a 403 from the object store as a missing body, and redacting the DSN and URL credentials the dry-run listing printed in clear

deploy/split-cloud/node/worker.env.example

@@ -24,6 +24,8 @@ ENCRYPTED_KEYS_PROVIDER=http
 ENCRYPTED_KEYS_BACKEND_URL=https://api.example.com
 ENCRYPTED_KEYS_WORKER_TOKEN=
 INTERNAL_API_TOKEN=
+# Only when the control plane sets one. Used for the brokered providers below.
+NODE_BROKER_TOKEN=
 
 # --- the bus and cache ------------------------------------------------------
 # TLS on both: the bus carries recipient addresses and the cache carries each