fix: fail-closed practice pin + operator gate for SIP secret reveal

- curogram-auth: pinPractice now fails closed. When CUROGRAM_PRACTICE_ID
  is set, a failed tenant pin clears the session and throws instead of
  silently operating against the account's default practice (which on a
  multi-practice account could read/send PHI for the wrong tenant).
- ringcentral-admin: revealing raw SIP credentials now also requires a
  startup-only operator gate, EXULT_RC_ALLOW_SECRET_READS=1, which a caller
  cannot self-grant — the self-returned approval_text alone is no longer
  sufficient. Startup banner reports the secret_reads state.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>