Review Security Hub findings and fix top

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Security Hub 2026-11-04: 31 open control failures (26 from the new apps-hosting root) → 18 closed: 10 real fixes applied live (CloudFront.15/.1, Athena.4 ×2, RDS.6/.9/.10, S3.9/.13/.20, SSM.1) and 8 by 4 new per-resource rules citing R-SOC-67..69 + the logs bucket on the S3.9 rule. Deferred: CloudFront.6, SecretsManager.1 ×2, ECR.2; other repos 9; hosting node 2. PR #7951 queued to the merge lane; quick gate, terraform test, three blind lanes pass. No UI surface affected. Memory: used mem-24381, mem-31190, mem-18338; proposed 1 recipe, 1 qa.