mt: make the guest-role migration self-healing
Remediate audit findings: SSRF userinfo bypass, guest role, C1 scope gaps