Security
- Harden privileged HTTP routes against cross-origin attacks: Added route-level middleware on
/cli/*and/recording/*that blocks cross-origin browser requests viaSec-Fetch-Siteheader validation, rejects POST requests withoutContent-Type: application/json(prevents the CORS preflight bypass viatext/plain), and enforces token authentication when token mode is enabled....