Restrict dashboard REPLACE_JOB from arbitrary classpath handlers

[hemju]

Security impact

REPLACE_JOB can change a pending job's handler type and serialized arguments. SpringJobHandlerResolver loads any class implementing JobHandler and creates an unregistered instance through Spring autowiring. The permission therefore grants substantially broader code-execution authority than its name suggests.

Acceptance criteria

• Restrict handler replacement to the annotation-discovered/explicitly registered handler allowlist, or require ADMIN to change handler type/arguments.
• Validate argument type compatibility before persisting a replacement.
• Make the privilege boundary explicit in dashboard documentation and audit events.
• Add security tests proving a REPLACE_JOB-only principal cannot select an arbitrary classpath handler.