Fail the render when the CSRF token cannot be stored
multithreaded: adopt lint block, fix clippy, fmt
Format the tree with rustfmt and add the lint + supply-chain gates
Remediate audit findings: SSRF userinfo bypass, guest role, C1 scope gaps