nwhitehouse's fork gets a real security pass

This is the kind of work you do once you've decided your product is going to hold real client information, not just demo data. The team turned on row-level security across tenant tables (so one customer's records are walled off from another's at the database layer), added server-side middleware to lock down HTTP headers, hardened how download links are issued, and added sanitisers so anything the AI assistant renders into the chat window can't smuggle in malicious markup.

Alongside the code, two security audit documents were added to the repo, and the fork's storage handling was consolidated to remove a duplicated client-and-server pathway that's a common source of bugs. A handful of older AI-vendor-specific code paths were retired in the same pass.