Close open uploads, image-proxy SSRF, fail-open AI quotas in production,
auth gaps on app routes, and MCP tenant isolation issues.
Co-authored-by: Cursor <cursoragent@cursor.com>
Next.js bakes public/ at build time — dynamically uploaded files were
never served in Docker standalone mode. Store uploads in data/uploads/
and serve via /api/uploads/ with a rewrite for backward compatibility.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
