Bootstrap project and safe work-item workflow

delivery_backlog/stories/US07-02-security-hardening.md

@@ -0,0 +1,23 @@
+# US07-02 — Harden API Authorization and Path Boundaries
+
+Epic: [E07](../E07-hardening-release.md)
+
+As an operator, I want the local application resistant to cross-origin and path attacks
+so another process or webpage cannot access photos or trigger mutations.
+
+## Acceptance criteria
+
+- Session authentication, Origin/Host checks, SameSite cookies, CSRF protection, and
+  restrictive CORS/default headers cover all mutation and media endpoints.
+- Asset IDs, repeated root validation, symlink defense, upload limits, and schema
+  validation prevent raw-path and race escapes.
+- Errors reveal no secrets, filesystem internals, or private metadata unnecessarily.
+
+## Automated tests
+
+- Black-box security tests cover missing/invalid auth, CSRF, hostile origins/hosts,
+  traversal, symlink races, malformed/oversized requests, and information leakage.
+
+## Dependencies
+
+- US07-01