Merge branch 'worktree-check-security-audit'

Security and frontend-correctness hardening: analytics IDOR fix, scraper
log scrubbing, lowercase email normalisation (migration 009), stale-response
guards in the plan hooks, busy flags cleared unconditionally across all
useLatestRequest consumers, Calendar no longer blanks on mutation, plus
dependabot/CI config and removal of the stray frontend/out.js.

Conflicts came from main's later "day assertions" restructure, which made
usePlannedDays read-only and replaced the calendar's per-day add/update with
useDayAssertions.assertDay. Both intents kept:

- usePlannedDays: branch's fetch machinery (isRefreshing, in-flight dedup,
  unguarded busy clear); mutators dropped as on main.
- usePlanSync: branch's useLatestRequest guard also applied to main's new
  syncWithWish.
- useDayAssertions / useLatestBalance (new on main): busy flag now cleared
  unconditionally, as the branch did for every other consumer.
- useDayAssertions.assertDay gains the branch's `skipRefresh` option and a
  `refresh`, so Calendar's multi-day save keeps the batch shape (N writes,
  one trailing bumpPlanVersion + one assertions refresh) on main's
  assertDay path. Branch's M7 tests ported from the removed add/update API
  to assertDay.
- PlanSyncProvider: branch's isAuthenticated gate kept; eviction-preview
  state stays removed as on main.
- usePlannedDayExclusions.ts stays deleted (superseded by useDayAssertions).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T4wjgbVL4HAC5Rdaw75VbV

backend/tests/unit/test_authz.py

@@ -285,6 +285,29 @@ class TestForeignWorkspaceIdIs404:
         )
         assert resp.status_code == 404
 
+    async def test_analytics_overview_foreign_child_in_own_workspace(
+        self, client: AsyncClient, two_workspaces: _TwoWorkspaces
+    ) -> None:
+        """R1: `workspace_id` is the caller's own (workspace A), but
+        `child_id` belongs to workspace B — the IDOR the router-level
+        `scope.check_child` guard closes (see `analytics.get_overview`).
+        """
+        resp = await client.get(
+            f"/api/analytics/{two_workspaces.ws_a.id}/overview",
+            params={"child_id": str(two_workspaces.child_b.id)},
+        )
+        assert resp.status_code == 404
+
+    async def test_analytics_projection_foreign_child_in_own_workspace(
+        self, client: AsyncClient, two_workspaces: _TwoWorkspaces
+    ) -> None:
+        """Same IDOR as above, on the sibling `/projection` route."""
+        resp = await client.get(
+            f"/api/analytics/{two_workspaces.ws_a.id}/projection",
+            params={"child_id": str(two_workspaces.child_b.id)},
+        )
+        assert resp.status_code == 404
+
     async def test_analytics_age4_foreign_parent(
         self, client: AsyncClient, two_workspaces: _TwoWorkspaces
     ) -> None: