Round 14: admin throttling, real Gemini cascade walk, CSP report-only, FK indexes - #81

Merged

bejranonda merged 9 commits into

mainfrom

claude/webapp-review-improve-dlhdzr

Jun 10, 2026

Commits on Jun 10, 2026

chore: restore optional win32 swc entry in lockfile
claude
committed
38ef1ba
feat(security): rate-limit all four admin mutation routes (30/min per IP)
claude
committed
75cf859
fix(chat): actually walk the Gemini cascade instead of only [0]
claude
committed
790b5c7
a11y(demo): give the emoji-only step-navigator buttons accessible names
claude
committed
7babd5a
feat(security): ship Content-Security-Policy in Report-Only mode
claude
committed
cfa3512
chore: remove duplicate root middleware.ts
claude
committed
15b3de6
feat(db): migration 0004 — secondary indexes on user_id FK columns
claude
committed
28ca6b1
docs: KNOWN_ISSUES — Round 14 status (FK indexes shipped, admin throttle closed, CSP report-only live)
claude
committed
a30363b
docs: Round 14 changelog entry
claude
committed
45d622f