fix(security): harden chat and content boundaries

[bokelley]

Summary

• enforce ownership and bounded history for Addie and Sponsored Intelligence sessions
• fail closed and preserve exact signed bytes across webhook integrations
• move SI policy into reviewed code and isolate mutable profile, skill, relationship, and article content as bounded untrusted context
• centralize external HTTP URL validation across REST, MCP tools, feed ingestion, and browser navigation/image sinks
• harden profile/admin authorization, JSON transport limits, feedback writes, and content-curator SSRF boundaries
• clear mutable SI prompt templates with a rolling-deploy-safe null-only compatibility constraint

Why

Security review found cross-user session access, fail-open or incorrectly verified webhook paths, mutable system-prompt injection, unsafe external URL sinks, unbounded model/context inputs, and inconsistent organization-role enforcement. Several alternate write paths and legacy stored values bypassed the first-pass controls.

Impact

Unauthorized session reads and writes now return the same not-found response, anonymous continuation uses signed HttpOnly capabilities, member-controlled values cannot become system instructions or executable links, and external fetches are bounded and SSRF-defended. The SI prompt column remains present but constrained to NULL for rolling-deploy compatibility; it can be dropped in a later migration after old instances are fully retired.

Validation

• independent security gate: clean
• independent code-quality gate: clean
• independent testing gate: clean
• focused unit/security suites: 112/112 plus final SI/privacy and inline-script regressions
• affected integration suites: 119/119
• TypeScript: tsc --project server/tsconfig.json --noEmit
• migration test from a fresh database: passed
• git diff --check: passed

The standalone Codex Security scan completed discovery, validation, and attack-path analysis but its CLI exporter failed on inconsistent internal evidence IDs. Its one high-severity finding in this PR's SI surface (inline-script JSON breakout) was fixed and independently re-reviewed; broader repository findings are queued for the next security wave.