security: close audit findings 1/2/4/7/9/11 and partially 3/16

[LeoWang331]

Summary

Hardens local proxy auth, config uninstall, and provider outbound requests.

Closes multiple items from a private 2026-07-28 security review. Full finding IDs, severities, and unfixed items stay in the private report — not listed here.

Details and remaining work are tracked privately.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5d0fa82c-001e-4c39-9b13-efa6445d0e88

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}