V3 Code v0.0.25 auth security patch

Built from PR #22 (auth-rate-limit-and-ws-origin).

Security & operational fixes

• Bootstrap rate-limit (10 req/min/IP, 429 on excess)
• Audit log on owner-role denials
• WebSocket Upgrade same-origin defence
• base64urlDecode round-trip guard in GitHub OAuth envelope
• turbo.json globalEnv extended so OAuth env vars actually reach child processes
• .env.example with full operator-facing env doc

Asset

• V3-Code-0.0.25-x64.exe — Windows NSIS installer, x64, 115 MB

🤖 Generated with Claude Code