docs: SSOT counts 406→408 (2 new MAX_SCAN_LENGTH tests for fullScan/isBlockedUrl)

fix: E2E audit — SSOT gaps, missing tests, docs reconciliation

fix: Session G — security hardening, SSOT reconciliation, landing page update

feat: multilingual injection detection — 18 German patterns + HTML comment injection

feat: demo preparation — script, attack scenarios, reset tools

fix: SSOT test count 366→367 (event mutation test added)

docs: E2E audit — update all counts to 367 tests, 142+ patterns, 70 corpus

feat: message_received hook mutates event.content with warning for Atlas + test

docs: Session F log — security hardening, OWASP expansion, 27+ issues closed

docs: SSOT update — 142+ patterns, 366 tests, 70 corpus, PII + LLM05 coverage

sec: Session F — security hardening, OWASP LLM02/LLM05 expansion, 366 tests

fix: SSOT audit — correct CSP claims, test count, category semantics

fix: message_received hook — use real OpenClaw event format (content field)

fix: remove CSP nonce — incompatible with Tailwind CDN

fix: add unsafe-eval to CSP for Tailwind CDN JIT compiler