fix(security+infra): Sprint Fix 1 — path traversal, docker-compose, CORS 965e8e0 unverified Claude commited on Apr 13