Pre release security auditing

[vagkaratzas]

High-priority fixes:

clustering.py: added MAX_ALL_PAIRS_MEMBERS = 1000. Communities at/below the cap keep the exact v2 all-pairs padding; above it, members connect to a single O(n) virtual hub (dropped from the returned coords) — same "keep disconnected members spread" effect without the quadratic edge count. Verified: an 8 000-member community now peaks at +3.2 MB / 0.064 s (was multiple GB). New regression test test_large_community_uses_hub_not_all_pairs; full suite 66 passed.

external.py: TTL cut from 24 h → 1 h; added MAX_TOKENS = 1000 enforced by _enforce_cap(), which runs before every write and evicts the oldest sessions (not reject — so an attacker can't deny the feature by keeping the store full). Combined with the per-request MAX_UPLOAD_BYTES cap, tmp/ is now hard-bounded to MAX_TOKENS * MAX_UPLOAD_BYTES regardless of request volume. New regression test test_external_storage_capped (posts 20 with cap 5, asserts ≤ 5 files remain); full suite 67 passed. Single-use delete-on-resolve was not taken — it would 404 a legitimate page refresh; TTL + count cap bound disk without that UX cost. Proxy limit_req and the chunked-transfer note remain deployment-side recommendations.

Medium-priority fixes:

┌─────────┬────────────────────────────┬──────────────────────────────────────────────────────────────────────────────────┐
│ Commit  │          Finding           │                                       Fix                                        │
├─────────┼────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ 15ac22b │ #1 malformed TSV → 500     │ catch EmptyDataError + reject empty mandatory cells → 400                        │
├─────────┼────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ d0d5620 │ #2 non-dict session        │ guard layers/nodes/edges are lists of objects → 400                              │
│         │ members → 500              │                                                                                  │
├─────────┼────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ 4068d63 │ #3+#4 weights              │ clamp non-positive/non-finite scaled_weight in shared build_graph + parser       │
│         │                            │ rejects non-finite TSV weights                                                   │
├─────────┼────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ 675d2bb │ #5 escapeHtml              │ add ' → '                                                                    │
├─────────┼────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ 29a6092 │ #6 channel color           │ escape color in value="…"                                                        │
├─────────┼────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ 33793e5 │ #7 external token          │ encodeURIComponent(token)                                                        │
├─────────┼────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ 04c5172 │ #8 rate limiting           │ nginx lapi/                                                                      │
└─────────┴────────────────────────────┴──────────────────────────────────────────────────────────────────────────────────┘