[Aug 28] Complete security testing and a second payroll run

[Avinash1286]

Harden the product and collect redundant mainnet evidence.

• Threat model
• CSP and referrer policy
• No-index claim pages
• Dependency audit
• Inspect requests and logs for plaintext leakage
• Exercise wrong-network, rejection, retry, and refresh failures
• Execute a second private payroll run

Exit criterion: no plaintext payroll leaks and four eligible pool hashes are targeted.