M0 security hardening: fix all vulnerabilities and resolve build errors

- Fix 5 source files corrupted with markdown formatting by previous AI
- Remove secret logging from auth middleware, signup, and recovery handlers
- Add role validation (ALLOWED_ROLES allowlist) to all 10 data_api + storage handlers
- Fix JavaScript injection in Deno runtime via double-serialization
- Add UUID validation to TUS upload paths to prevent path traversal
- Gate token issuance on email confirmation (AUTH_AUTO_CONFIRM env var)
- Reject unconfirmed users on login with 403
- Prevent OAuth account takeover (409 on email conflict with different provider)
- Replace permissive CORS (allow_origin Any) with ALLOWED_ORIGINS env var
- Wire session-based admin auth into control plane, add POST /platform/v1/login
- Hide secrets from list_projects API via ProjectSummary struct
- Add missing deps (redis, uuid, chrono, tower-http fs feature)
- Fix http version mismatch between reqwest 0.11 and axum 0.7 in proxy
- Clean up all unused imports across workspace

Build: zero errors, zero warnings. Tests: 10 passed, 0 failed.
Made-with: Cursor

functions/src/deno_runtime.rs

@@ -113,8 +113,12 @@ impl DenoRuntime {
         runtime.execute_script("<user_script>", code.to_string())?;
 
         // 3. Invoke Handler
+        // Double-serialize to prevent JS injection: the outer JSON string is parsed
+        // by JSON.parse() in JS, producing the original value safely.
         let payload_json = serde_json::to_string(&payload.unwrap_or(serde_json::json!({})))?;
         let headers_json = serde_json::to_string(&headers)?;
+        let safe_payload = serde_json::to_string(&payload_json)?;
+        let safe_headers = serde_json::to_string(&headers_json)?;
         
         let invoke_script = format!(r#"
             (async () => {{
@@ -122,16 +126,16 @@ impl DenoRuntime {
                     return {{ error: "No handler registered via Deno.serve" }};
                 }}
                 try {{
-                    const headers = {1};
+                    const headers = JSON.parse({1});
+                    const body = JSON.parse({0});
                     const req = new Request("http://localhost", {{ 
                         method: "POST", 
-                        body: {0},
+                        body: typeof body === 'string' ? body : JSON.stringify(body),
                         headers: headers
                     }});
                     const res = await globalThis._handler(req);
                     const text = await res.text();
                     
-                    // Convert Headers to plain object for return
                     const resHeaders = {{}};
                     if (res.headers && typeof res.headers.forEach === 'function') {{
                         res.headers.forEach((v, k) => resHeaders[k] = v);
@@ -146,9 +150,10 @@ impl DenoRuntime {
                     return {{ error: String(e) }};
                 }}
             }})()
-        "#, payload_json, headers_json);
+        "#, safe_payload, safe_headers);
 
         let result_val = runtime.execute_script("<invocation>", invoke_script)?;
+        #[allow(deprecated)]
         let result = runtime.resolve_value(result_val).await?;
         
         let scope = &mut runtime.handle_scope();