feat: add policy layout components and enhance policy details page - #273

…, GH-79, GH-78, GH-53, GH-54 (#3576)

* fix(mcp-server): bind serve to localhost and reject foreign origins

GH-273: the streamable HTTP server bound 0.0.0.0 with
Access-Control-Allow-Origin: * and no request authentication, so any
website the operator visited could drive the local MCP server with the
CLI-configured API key, and the LAN could reach it too.

- bind to 127.0.0.1 by default (new --host flag to opt out)
- drop the wildcard CORS middleware (MCP HTTP clients are not browsers)
- reject POST /mcp with a non-localhost Origin header (browsers always
  send one; header-less local MCP clients keep working with --apikey)

* fix(portal): scope policy signature and pdf endpoints to caller's org

GH-93 / GH-79 / GH-245: portal policy endpoints looked policies and
policy versions up by bare id with no organization scoping, letting any
authenticated portal user sign policies in other tenants or fetch a
presigned URL for another org's policy PDF.

- mark-policy-completed: resolve the member within the policy's
  organization (also fixes the arbitrary-membership pick for
  multi-org users)
- accept-policies: skip policies outside the member's organization
- policy-pdf-url: scope the versionId lookup to the policy whose org
  membership was already validated

* fix(security): mask all text and media in sentry session replay

GH-101: session replay ran in production with maskAllText: false and
blockAllMedia: false while the sentry-mask escape hatch was used in zero
of ~1470 components, recording customer compliance data verbatim.

Default to masking everything; data-sentry-unmask is now the opt-in for
elements provably safe to record.

* fix(email): remove hardcoded fallback secret for unsubscribe tokens

GH-100: the unsubscribe-token HMAC key silently fell back to the public
literal 'fallback-secret' when neither UNSUBSCRIBE_SECRET nor AUTH_SECRET
was set, and apps/api (which never sets either) verifies the
unauthenticated POST /v1/email/unsubscribe endpoint with it, making every
token forgeable from source.

Resolve the secret lazily and fail closed: generating a token without a
configured secret now throws. Documented UNSUBSCRIBE_SECRET in
apps/api/.env.example.

* fix(api): validate organizationId before building upstash vector filters

GH-103: findSimilarContent and findSimilarContentBatch interpolated
organizationId into the Upstash Vector metadata filter with no escaping,
so a value containing a quote could append arbitrary filter clauses
(e.g. OR organizationId GLOB "*") and dump every tenant's RAG chunks.

Allowlist the prefixed-CUID shape and fail closed before the filter
string is built, in both query paths and the sync readiness check.
Adds regression tests for the literal exploit payload.

* fix(api): honor securityQuestionnaireEnabled on token questionnaire upload

GH-78: POST /v1/questionnaire/parse/upload/token validated the trust
access token and ran RAG auto-answering without checking
Trust.securityQuestionnaireEnabled, so an org that disabled the AI
questionnaire was still fully served by any token holder.

Check the flag after token validation and return 403 when disabled;
defaults to enabled when no Trust row exists, matching the public
overview helper's semantics.

* fix(api): scope organization logo keys to the owning organization

GH-53: UpdateOrganizationDto.logo accepted any string, it was stored
verbatim, and GET /v1/organization presigned it as a raw S3 key against
the shared org-assets bucket - a cross-tenant read of any known key.

Reject logo keys not prefixed with the organization's own id on update,
refuse to presign out-of-org keys on read, and skip presigning
out-of-org logos in the app layout.

* fix(api): reject cross-organization fileKeys in evidence form submissions

GH-54: evidence form file fields accepted any non-empty fileKey, stored
it verbatim, and the submissions read path presigned it against the
shared attachments bucket - a cross-tenant read given a leaked key.

Validate every submitted fileKey against the caller's organization
prefix on create, and skip presigning out-of-org keys when refreshing
download URLs on read (defense in depth for legacy rows).

* fix(app): verify run ownership in task status route via org tags

GH-257: GET /api/tasks/[taskId]/status returned any Trigger.dev run's
output to any authenticated user with no ownership check, exposing other
tenants' AI-generated policy, questionnaire, and vendor content to
whoever learned a run id.

Tag every user-triggerable tasks.trigger call with the owning
organization id and require a matching tag before returning run data;
mismatches get the same 404 as a missing run. research-vendor runs are
tagged when an active org exists (its output is shared, not tenant
data). Adds route tests for the cross-tenant and untagged cases.

* fix: refine access checks and legacy MCP maintenance

* fix(security): address review feedback on csv export, batch fix tags and run status rbac

- exportCsv skips presigning fileKeys outside the organization prefix
- derive the batch fix run tag from the created batch, not caller input
- require task:read on the task run status route

---------

Co-authored-by: tofikwest <tofik@trycomp.ai>