fix: resolve P0 security issues per governance baseline

P0-01: LIKE injection fix in device.go (2 locations)
- Added escapeLikePattern() to prevent LIKE pattern manipulation

P0-03: Token refresh blacklist fail-closed
- RefreshToken() now returns error if cache.Set fails
- Prevents token double-spend on cache failures

P0-05: CORS dangerous default configuration
- Default changed to empty origins, credentials off
- init() panics if default config is dangerous

P0-06: UpdateUser IDOR vulnerability fix
- Added authorization check (self-or-admin)
- Prevents unauthorized user profile modification

Also: Fixed frontend lint errors in device-fingerprint.test.ts and http/index.test.ts

All 518 frontend tests pass, all backend tests pass.

frontend/admin/src/lib/http/index.test.ts

@@ -1,8 +1,6 @@
 import { describe, expect, it } from 'vitest'
 
 import * as httpIndex from './index'
-import * as client from './client'
-import * as authSession from './auth-session'
 import * as errors from '@/lib/errors'
 
 describe('lib/http/index', () => {