[Epic] Security and privacy

[imsouza]

Owner: @imsouza

Outcome:
Maintain owner authentication, secret handling, local-first controls, and secure external-provider consent.

Acceptance criteria:

• Scope is implemented with persisted, non-mock data where applicable.
• Success, empty, degraded, and failure states are covered.
• Automated tests and documentation are updated.
• Evidence is attached before closure.