Add docs navigation and tighten API request security

docs/security-review-2026-10-11.md

@@ -0,0 +1,22 @@
+# Security and bug review — 11 October 2026
+
+## Fixes
+
+- Contributor tokens previously inherited the account's staff privileges and could issue other tokens or approve device pairing. Staff operations, token management, and pairing approval now require a verified account session and reject Authorization credentials. Upload and contribution token authentication remains supported.
+- Multiplayer room creation was limited by a replaceable browser cookie. It now also has a durable account limit of 20 attempts per hour, preventing cookie resets from bypassing the limit.
+- Oversized streamed JSON requests now stop reading and return HTTP 413 instead of HTTP 400. The existing two-MiB byte limit remains in place.
+- Workflow's transitive `devalue` and `nanoid` dependencies are pinned to patched 5.9.4 and 5.1.16 releases through scoped npm overrides. Workflow remains at 5.2.0. The production dependency audit initially reported 14 affected packages through these dependency chains.
+
+## Verification and remaining scope
+
+Regression tests cover rejected device credentials, verified session requirements, cookie rotation against the account limit, independent account limits, streamed request cancellation, the byte-limit boundary, UTF-8 JSON, and malformed JSON. Run `npm test`, `npm run typecheck -- --incremental false`, `npm run build`, and `npm audit --omit=dev` to reproduce the checks.
+
+Final results: 123 tests passed; TypeScript and the production build passed; npm reported zero known production dependency vulnerabilities. Production deployment `dpl_ArAsMvBHhSqVQSsy5G1yzZaXyvUL` reached READY. Eleven safe HTTP checks confirmed token rejection for staff/credential endpoints, signed-out access rejection, oversized-body HTTP 413, malformed-JSON HTTP 400, and working health/docs pages. No production test records were created.
+
+The live Supabase review found no public-schema application functions executable by `anon` or `authenticated`. Its RLS-enabled tables without policies are intentionally restricted to server access; adding permissive policies would weaken that restriction.
+
+Supabase also flags disabled leaked-password protection. This setting requires Pro or above, so no billing or plan change was made. See [Supabase password security](https://supabase.com/docs/guides/auth/password-security).
+
+This was a focused application and production-dependency review, not a complete penetration test or a guarantee that every bug has been found.
+
+Patched upstream releases: [devalue](https://github.com/sveltejs/devalue/releases/tag/v5.9.3), [nanoid](https://github.com/ai/nanoid/releases/tag/5.1.16).