Lef-F audits the patches they just merged

Lef-F cherry-picked eight changes from another Mike fork - a mix of security hardening, support for OpenRouter as a third AI model provider, and user-configurable connectors that let Mike call out to external tools and services. Original authorship was preserved on every commit.

Then came the audit. Lef-F's review turned up four serious security gaps the upstream patches had either missed or newly opened, plus eight real bugs in features that had already shipped to users. One gap re-opened the exact vulnerability an upstream fix had just closed in a neighbouring file. Another left the most sensitive table - the one holding access tokens for those outside connectors - unlocked while every other user-data table was sealed off. Lef-F also extended Mike's existing at-rest encryption to cover those connector credentials, which an earlier migration had explicitly flagged as deferred work.