Hybrid Core 5.1.0-0924-01 SECURITY ROUTES

- Core now owns the legacy /hybrid_access/card/{token} secure profile route.
- Email OTP send and verification routes are native to Core.
- Secure profile responses deny framing, referrers and caching.
- Non-admin direct access to hybrid_board_access is denied by Core.
- Receiver-wide workforce administration remains central-admin only.
- Regular users must use Board-scoped Operations and explicit Board permissions.
