Security: INT-A21 bind browser-minted editor tokens to the forge session; INT-A22 validate room paths before they enter the shared doc and cap control frames; INT-A7/A8 preview header allow-list extracted with tests
11 files changed+185−52
Rendering diff…