Add security assessment and remediation plan

[JacksCodeVault]

This pull request adds a comprehensive security assessment and remediation plan for the project. The document identifies several critical and high-severity vulnerabilities, provides practical exploit examples, and gives actionable remediation steps. It also includes ready-to-use PR review summaries and inline comment snippets for code review, making it easier to communicate security requirements to the team.

The most important changes are:

Critical Security Findings (P0):

• Documents several broken access control issues (IDOR) in conversation and document endpoints, showing that any authenticated user can access or delete other users' data due to missing authorization checks.
• Highlights a denial-of-service risk in the upload handler, which reads entire files into memory without size limits, and recommends streaming uploads and enforcing strict size caps.
• Notes the lack of brute-force protection on the login endpoint, exposing the system to credential stuffing attacks, and suggests rate limiting and lockout mechanisms.

High Severity Issues (P1):

• Points out that any authenticated user can change the global LLM mode, which should be restricted to admins only.
• Identifies that internal errors are leaked via chat SSE events, recommending more generic error messages for clients and better server-side logging.

Security Review Tools:

• Provides ready-to-paste markdown summaries and inline comment templates for

[Copilot]

Pull request overview

Adds a new security assessment and remediation plan document intended to help instructors and student developers identify and address high-impact security gaps in the current API (authorization scoping, upload DoS risk, brute-force login protection, admin-only system settings, and SSE error leakage).

Changes:

• Introduces a severity-ranked set of security findings (P0–P2) with repro steps and remediation guidance.
• Provides ready-to-paste PR review summaries and inline comment templates to standardize security feedback.
• Includes an instructor-facing note framing P0 items as release blockers and emphasizing regression tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[charliecreates]

Non-blocking feedback (2)

1. Clarify the trust boundary this assessment assumes — .../docs/security-assessment-and-remediation-plan.md#L17-L173
   The repo currently contains both team-shared wording (Readme.md, server/db/init.sql) and per-user wording (docs/implementation.md). Since P0-1, P0-2, and P1-1 severity depends on that boundary, add a short assumptions/source-of-truth section so readers know whether these are policy violations or intentional team-level behavior.

2. Add concrete code pointers for each P0/P1 finding — .../docs/security-assessment-and-remediation-plan.md#L22-L160
   The findings are directionally strong, but remediation will be faster if each item references exact backend symbols/routes (for example server/app/routers/conversations.py, server/app/routers/documents.py, server/app/routers/auth.py, server/app/routers/system.py, server/app/routers/chat.py). That also makes severity discussions more objective during review.

If you want Charlie to apply these doc edits directly, reply with please fix 1-2.