open-legal-products hardens Mike's front door

This security pass adds protections against a common server-side attack in which a malicious request tries to make an application reach internal or otherwise restricted systems. It also narrows which outside websites can make browser-based requests to Mike, reducing exposure to unapproved web clients.

The team has also tightened validation around project chat requests and documented the security assumptions for teams running Mike themselves. One practical wrinkle remains: the new browser and outbound-request controls need to accommodate legitimate local integrations.