chore(rebar): Pier_T_rebar 작업 폴더 초기 구성 및 외부 의존 파일 통합

- Code\rebar_pipeline, review_pipeline, pier-program을 정션에서 실제 폴더로 전환
- Code\rhino_mcp 및 CLAUDE_rhino배경.md 추가, .mcp.json은 PYTHONPATH로 새 위치 사용
- pier-program 내부 .git 제거(이력은 backup\pier-program_20261028.bundle에 보관)
- worktree 가이드 반영(CLAUDE.local.md, HANDOFF.md)
- D:\Rhino-MCP 경로 참조를 새 위치로 치환

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.hmcmkit/knowledge/templates/infra/security/security-layer.yaml.template

@@ -0,0 +1,130 @@
+# Security Layer Templates — Auto-generated by hmcmkit security-architect
+# 8 Security Components for Enterprise deployments
+
+---
+# 1. CloudFront Distribution
+apiVersion: cloudfront
+kind: Distribution
+spec:
+  origins:
+    - domainName: ${alb_domain}
+      originProtocolPolicy: https-only
+  defaultCacheBehavior:
+    viewerProtocolPolicy: redirect-to-https
+    allowedMethods: [GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE]
+  webACLId: ${waf_acl_arn}
+  comment: "hmcmkit-managed CDN + DDoS protection"
+
+---
+# 2. AWS WAF — OWASP Top 10
+# Apply via Terraform: aws_wafv2_web_acl
+waf_rules:
+  - name: AWSManagedRulesCommonRuleSet
+    priority: 1
+    vendor: AWS
+  - name: AWSManagedRulesSQLiRuleSet
+    priority: 2
+    vendor: AWS
+  - name: AWSManagedRulesKnownBadInputsRuleSet
+    priority: 3
+    vendor: AWS
+  - name: rate-limit
+    priority: 10
+    limit: 2000  # requests per 5 minutes per IP
+
+---
+# 3. VPC Design
+vpc:
+  cidr: "10.0.0.0/16"
+  subnets:
+    public:
+      - "10.0.1.0/24"   # ALB, NAT Gateway
+      - "10.0.2.0/24"
+    private:
+      - "10.0.10.0/24"  # EKS nodes, application
+      - "10.0.11.0/24"
+    database:
+      - "10.0.20.0/24"  # RDS (no internet access)
+      - "10.0.21.0/24"
+  nat_gateway: single  # staging: single, prod: per-az
+
+---
+# 4. IAM — IRSA (IAM Roles for Service Accounts)
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ${project_name}-api
+  namespace: ${environment}
+  annotations:
+    eks.amazonaws.com/role-arn: arn:aws:iam::${aws_account_id}:role/${project_name}-${environment}-api
+
+---
+# 5. Network Policy (Calico/Cilium)
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ${project_name}-api-policy
+  namespace: ${environment}
+spec:
+  podSelector:
+    matchLabels:
+      app: ${project_name}-api
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: ingress-nginx
+      ports:
+        - port: 3000
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              name: ${environment}
+      ports:
+        - port: 5432  # PostgreSQL
+        - port: 6379  # Redis
+
+---
+# 6. ACM + cert-manager
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod-key
+    solvers:
+      - http01:
+          ingress:
+            class: nginx
+
+---
+# 7. Secrets Rotation Policy
+secrets_rotation:
+  provider: aws-secrets-manager
+  rotation_interval: 30d
+  secrets:
+    - name: db-credentials
+      type: rds
+      auto_rotate: true
+    - name: api-keys
+      type: custom
+      auto_rotate: false  # manual rotation
+
+---
+# 8. Backup & DR
+backup:
+  rds:
+    retention_period: 7     # days (staging)
+    # retention_period: 35  # days (production)
+    copy_to_region: ap-northeast-1  # Cross-region backup
+    snapshot_schedule: "cron(0 3 * * ? *)"  # Daily 3AM UTC
+  s3:
+    versioning: true
+    lifecycle_rule:
+      transition_to_ia: 30   # days
+      transition_to_glacier: 90