Security Hardening Across the Platform

- Helmet.js HTTP security headers applied across all API endpoints - Redis-backed rate limiting enforced per-route and per-user (not just globally) - Webhook signature verification strengthened for Twilio, Nango, and Stripe - Improved input validation and sanitization on all inbound channels - Internal access scoped to minimum required permissions