fix: dynamic coordinator routing + boxed doctor parsing (#279)

feat(refactor): ready for manual QA after main sync (#274)

fix(security): enforce server-side actor identity (#224)

feat: phase 1 workspace isolation across auth and core APIs (#112)

feat: audit hardening, webhook retry, and local Claude session tracking (#68)

chore: CODE_OF_CONDUCT, issue templates, DELETE patterns, limit caps, CSRF origin check

fix: strict mode, test stubs, pagination counts, N+1 queries, CSP hardening

fix: add auth checks on all GET endpoints, timing-safe comparisons, and XSS sanitization

feat: initial open-source release