secure-change

Security and privacy review for a scoped mivia change. Check authz, secrets, SSRF, injection, path safety, prompt-injection, and fail-closed defaults. Report with mivia-report/v1.