fix(core): security hardening — auth fail-closed, arg injection, secret file perms

[medomar]

Summary

Security hardening batch from a full-project audit. Fixes the critical fail-open paths and the quick-win HIGH findings. Each item was verified against the actual code path; tests updated to assert the new fail-closed behavior.

ID	Severity	Fix
C1	Critical	Empty auth.whitelist now fails closed (denies all) instead of authorizing everyone. New opt-in auth.allowAllSenders flag for local dev. Paired users still authorized via access_control.
C2	Critical	Strip path components from attacker-controlled email MIME attachment filenames (basename + ./.. guard) — blocks arbitrary file write via crafted .eml.
H1	High	checkAccessControl fails closed: a getAccess DB error denies (was: allow); an unknown/corrupt role falls back to viewer (was: unrestricted). /role & /approve default an un-provisioned caller to viewer, not owner.
H2	High	Neutralize CLI argument injection: a positional prompt beginning with - is space-prefixed so it can't be parsed as a flag (e.g. --dangerously-skip-permissions, --mcp-config).
H3	High	Unknown spawn profile falls back to read-only tools instead of leaving the worker unrestricted.
H6	High	Per-worker MCP temp config and .openbridge/mcp-config.json written with mode 0600 (they hold raw MCP tokens).
H7	High	IMAP TLS cert verification on by default; opt out via options.allowInsecureTLS.
M4	Medium	config.json written with mode 0600 (holds bot tokens / MCP env).

Breaking change

V0 configs that relied on an empty whitelist for open access will now deny all senders. Either add entries to auth.whitelist, or set auth.allowAllSenders: true (intended for local/console dev only). A loud startup error explains this when the whitelist is empty.

Testing

• npm run typecheck, npm run lint, npm run build — pass.
• npm run test — 5518 pass. Updated 7 tests that encoded the old insecure behavior; added opt-in/fail-closed assertions.
• 2 unrelated failures remain and are pre-existing on develop (date-dependent naming-series year-rollover; flaky pdf-processor OCR timeout) — not touched by this PR.

Not included (larger redesigns, follow-up)

C3 (FileServer auth + public-tunnel exposure), H5 (OpenAPI SSRF allowlist), H8 (WebChat 0.0.0.0 default + token-in-URL), plus medium items M1–M7. Happy to tackle these in separate PRs.