Merge pull request #15 from iblai/fix/2147-jwt-replay-jti

fix(identity): detect JWT replay via jti binding (#2147)

Merge pull request #14 from iblai/fix/2146-chromadb-unauthenticated

fix(vector): require token auth on ChromaDB vector store (#2146)

Merge pull request #13 from iblai/fix/2145-jwt-cleartext-security-hea…

…ders

fix(gateway): reject cleartext Bearer tokens + set security headers (…

Merge pull request #11 from iblai/fix/2144-rate-limiting

feat(gateway): add rate limiting to the MCP gateway (#2144)

Merge pull request #10 from iblai/fix/2143-readmemory-symlink-traversal

fix(mcp): block symlink path traversal in read-memory (#2143)

Merge pull request #8 from iblai/fix/2141-cache-table-acl

fix(authz): enforce cache_tables ACL on cache queries (#2141)

Merge pull request #8 from iblai/fix/2141-cache-table-acl

fix(authz): enforce cache_tables ACL on cache queries (#2141)

Merge pull request #7 from iblai/fix/2140-self-service-ownership

fix(authz): self-scope subject tools for self-service roles (#2140)

Merge pull request #6 from iblai/fix/2139-ldap-injection

fix(ldap): escape LDAP filter inputs to stop injection (#2139)

Merge pull request #5 from iblai/fix/2138-role-header-privesc

fix(identity): derive role from JWT, not X-Iblai-Role header (#2138)