v4.12.1 — security remediation

Closes nineteen findings from an independent security audit (code review across MLSecOps, data, API/web and infrastructure, plus a live penetration test). Each fix carries a regression test under tests/security_audit/.

High — admin-panel stored XSS → privilege escalation (closed in four layers); webapp/ column-ACL bypass (real principal now threaded); world-readable secrets/data files (owner-only via core/fileperms.py).

Medium — internal model endpoint no longer leaks in error text on either the v1 or v2 path (the v2 turn leak was found by a post-remediation live re-test); HTTP security headers + --no-server-header; cached /health; CSV/Excel formula-injection defused; warehouse values fenced in the prompt; Flask login hardened (self-lifting throttle, hardened cookies, session-bound CSRF); dependencies pinned with requirements.lock and pip-audit in CI.

Full suite green (2760 passed). See CHANGELOG.md for the complete list.