CLI surface locked; security pass

CLI command surface, flags, and machine-readable output contract frozen. Security review found no critical issues. Server confirmed to not log or store plaintext, filenames, or MIME types in any code path.