docs: Python/FastAPI backend audit (main@cfccbbb)

[wu1w]

Read-only audit of the Python/FastAPI backend on latest main.

This PR contains only docs/audit-python-backend-2026-08-18.md. No product, test, or CI code is changed.

Audited SHA

cfccbbb9ed3a8a489097aa3a6e42ee0049a66e43

backend-ci (from GitHub logs, not guessed)

Current main is red because Ruff F541 fails first (backend/agent/loop.py:393 and :3477, unused f prefixes, introduced in 4133b5f). Pytest never runs on the last three pushes.

The last time tests actually ran on main (81581cc) failed ~50 assertions (i18n copy drift, workforce/inbox semantics, tool-policy snapshots). Earlier the same week, version sync failed (0.4.2 vs 0.5.0-alpha); that is already aligned at 0.4.3 on HEAD.

Report includes

• Findings ranked critical / high / medium / low with paths and suggested fixes
• Session delete, draft restore, tool stop, static stale — what cfccbbb actually closed vs leftover gaps
• python / web_search / configure_tevarn — Windows event loop, integer-string schema, status vs overview
• Auth, multi-user isolation, knowledge/docs path traversal
• Blocking I/O on the event loop and outbound HTTP timeouts
• Error handling, Pydantic v1/v2, settings/secrets
• “What looks solid”

No Critical finding on the default single-user desktop threat model. Highest leftovers: incomplete tool stop, CI hiding pytest, multi-user trace IDOR, event-loop spill I/O, image HTTP with no timeout.