Harden security, sync, and query subsystems
Audit Run 14: tests, indexes, JSDoc, plugin comments, migration headers