[SEC-01] Perform security and privacy review

[Krisor1986]

Goal

Review ClientFlow before public deployment.

Tasks

• Review password and token handling
• Verify tenant isolation
• Validate roles and permissions
• Restrict file types and upload sizes
• Review secrets and environment variables
• Review personal-data consent and retention
• Document risks and mitigations

Acceptance criteria

• No known critical security issue remains
• Secrets are not stored in the repository
• The privacy decisions are documented

Dependencies

• [TEST-01]