Security fixes: okf serve remote-bind gating + token auth, https-only git
URLs, dashboard CORS + token, MCP option-injection guard, path-traversal
hardening (concept_id, session ids, symlinks), PID file safety, pinned
dependencies + committed uv.lock + pip-audit in CI.

Also: unified LLM client resolution + bundle reader, stricter ruff rules,
repo hygiene (dockerignore, non-root Docker, sdist fix), config numeric
coercion fix, docs consistency, 8 new security regression tests.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>