Harden security, sync, and query subsystems
Audit remediation: observability, documentation
Theme standardization, plugin sandboxing, sync service split, integration tests
Initial commit