Exorcise sweep: strip AI tells from server copy, comments, and docs
Frontend: kill media-picker XSS; render_string surfaces errors