feat: harden local mission control security

[lucajmarangoni-cmd]

Summary

Hardens Minions for safer local and proxied operation without changing its core task/session model.

• adds centralized security configuration, Basic Auth support, CORS/origin checks, DNS-rebinding protection, security headers, and body limits
• constrains file operations to the workspace sandbox and adds upload limits
• hardens Hermes worker environment handling and crash recovery
• makes production asset copying cross-platform
• documents deployment/security configuration and client credential behavior

Verification

• npm test
• npm run build
• dedicated security, filesystem sandbox, file route, worker environment, and crash-resilience regression tests

Notes

This intentionally keeps authentication optional for loopback/local use. Deployments exposed through a proxy should configure credentials and trusted origins as documented in docs/SECURITY-HARDENING.md.

[Jelloeater]

@lucajmarangoni-cmd that would be dope!