Robin Choice
c949d6b829
fix: security hardening and stem multi-select
- Remove public /migrate endpoint (startup migration handles it)
- Add membership + canUpload check to POST /versions/track/:trackId
- Add membership check to stream-url, download-url, waveform endpoints
- Scope member PATCH/DELETE to projectId to prevent cross-project mutation
- Add auth + membership check to POST /comments/:id/resolve
- Add secure: true to session cookie in production
- Hash magic link tokens before storing (was plaintext)
- Return generic error message instead of err.message
- Fix stem multi-file-select: replace hidden attr with CSS offscreen
(Safari/WebKit drops multiple selection on display:none file inputs)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>