Security & Loose Ends Audit

Summary

Audit prompt for recent changes covering security (input validation, authz, injection, secrets, data exposure, crypto, sessions, supply chain including the repository security baseline in private capsule) and loose ends (dead code, TODOs, error handling, consistency, tests, docs drift). Fixes in-scope findings and lists pre-existing issues separately.