[security] Security audit — OWASP checks, rate limiting review, input sanitization

[enioxt]

TASK-042 related + new

No security-focused issues exist. This covers:

• Auth backend (JWT validation, session management)
• Rate limiting review per endpoint
• Input sanitization (Cypher injection, prompt injection)
• CORS policy audit
• CPF masking validation across all outputs
• API key rotation policy

Priority: P1
Area: Security