Merge feat/goo-175-phase3-ws3b-bull-board into master

6 commits covering:
- BullMQ Redis split + Prometheus queue metrics + Bull Board admin UI
  (RFC-004 Phase 3 WS1 / WS3a / WS3b)
- Dual-key JWT verification for WebSocket auth
- Test infrastructure stubs + AVM spec fix (GOO-131)
- Complete MFA grace period feature for required roles + SLO monitoring

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

prisma/schema.prisma

@@ -56,10 +56,17 @@ model User {
   updatedAt           DateTime  @updatedAt
 
   // MFA fields
-  totpSecret      String? // Encrypted TOTP secret
-  totpEnabled     Boolean   @default(false)
-  totpBackupCodes String[] // Bcrypt-hashed backup codes
-  totpEnabledAt   DateTime?
+  totpSecret         String? // Encrypted TOTP secret
+  totpEnabled        Boolean   @default(false)
+  totpBackupCodes    String[] // Bcrypt-hashed backup codes
+  totpEnabledAt      DateTime?
+  /// First login under MFA enforcement when the user had not yet enrolled.
+  /// Used to compute the remaining grace period before enrollment becomes
+  /// mandatory for roles in MFA_REQUIRED_ROLES (currently ADMIN).
+  mfaGraceStartedAt  DateTime?
+  /// Last successful MFA verification (TOTP or backup code). Used by the
+  /// admin re-auth interceptor for sensitive operations.
+  mfaLastVerifiedAt  DateTime?
 
   agent                Agent?
   listings             Listing[]