Security: fix post-audit feature review findings POST-B1..B7 (AI suggestions billed to the viewer, no owner usage leak, container plan gate on sync/preview, safe admin stop, one background tree walk per key, token imports always private).
7 files changed+27−7
Rendering diff…