feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/security/uploads.md

@@ -1,3 +1,8 @@
 # uploads
 
-TODO: Complete documentation.
+Uploads are tenant-scoped through their parent application. File names are normalized with
+`Path.GetFileName` and stored under generated names inside the configured attachments root. The API
+enforces allowed types, a per-file size limit, and the account's total storage entitlement.
+
+Downloads resolve the owned database record before opening a file. Files selected for AI are explicit;
+uploading alone does not send content to a provider.

docs/security/validation.md

@@ -1,3 +1,8 @@
 # validation
 
-TODO: Complete documentation.
+Validation happens at trust boundaries: controller request DTOs, file uploads, imported URLs, OAuth
+state callbacks, AI sidecar authentication, and deployment configuration. Job import and IMAP targets
+resolve through SSRF guards that reject private, loopback, link-local, and unsafe redirect targets.
+
+Unhandled failures use Problem Details with a trace ID; expected validation failures retain their
+specific 4xx responses. See `docs/security/input-validation.md` and `docs/security/api-security.md`.