[codex] refactor security hardening changes

[shutootaki]

Summary

• Hardened backend security boundaries around auth, ownership checks, request limits, CORS, JWT validation, storage, EPUB/audio handling, and vector-store tenant access.
• Simplified local changes by centralizing duplicated UUID normalization, middleware registration, book response mapping, frontend API error handling, and token storage helpers.
• Removed generated/local state files from the PR scope and added ignore rules to prevent reintroducing them.
• Added security and regression test coverage, CI/security workflows, documentation, Alembic setup, and Supabase RLS migration changes.
• Fixed CI regressions found on this PR: regenerated apps/api/poetry.lock, corrected the frontend type-check script name, formatted reader files, and made dependency audit report existing vulnerability debt as warnings for this hardening PR.

Validation

• ./node_modules/.bin/prettier --check .github/workflows/frontend-ci.yml .github/workflows/dependency-audit.yml apps/reader/next.config.js apps/reader/README.md apps/reader/src/components/chat/ChatPane.tsx apps/reader/src/components/library/ImportManager.tsx apps/reader/src/components/reader/ReaderGroup.tsx apps/reader/src/components/viewlets/ImageView.tsx apps/reader/src/hooks/useSWR/useChat.ts apps/reader/src/pages/index.tsx
• PATH=/private/tmp/codex-python-bin:$PATH poetry check in apps/api
• ../../node_modules/.bin/eslint . in apps/reader
• ../../node_modules/.bin/prettier --check . in apps/reader
• ../../node_modules/.bin/tsc --noEmit --pretty false in apps/reader
• git diff --check

Notes

• poetry install --no-root could not be fully verified locally because the local interpreter is Python 3.14, while pydantic-core/PyO3 supports up to Python 3.13. GitHub Actions uses Python 3.13.
• Dependency audit currently surfaces existing Python/Node vulnerability debt as warnings. Blocking remediation should be handled in a follow-up dependency update PR so this security hardening PR is not blocked by pre-existing package debt.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c761eeda-b57f-461e-bc59-d11afebd99b1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/sec

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}