Security Hardening

Webhook auth-before-body parsing, SSRF guards for web tools, and plugin route ownership validation.

No detailed content for this feature yet.