[WIP] Add tests for protected routes and CI secrets documentation

[Copilot]

Security Testing & Access Guard Implementation

• Create tests/security/ directory structure for security tests
• Create authentication security tests (10 tests)
• Create protected route tests (15 tests for auth checks, IDOR prevention, data leakage)
• Create rate limiting tests (10 tests)
• All 35 security tests passing
• Fix pydantic v2 compatibility issues (regex→pattern, any→Any)
• Fix JWT error handling for PyJWT library compatibility
• Add GitHub Actions workflow for security tests
• Create /docs/secrets.md documentation for GitHub Encrypted Secrets
• Create /reports/security.md with findings and recommendations
• Add .github/CODEOWNERS file with security team assignments
• Document least-privilege PR review requirements
• Clean up repository (remove pycache, add root .gitignore)

Summary:
✅ 35 comprehensive security tests covering authentication, authorization, IDOR, data leakage
✅ Complete CI/CD security testing workflow with bandit, safety, gitleaks
✅ Detailed secrets management documentation (docs/secrets.md)
✅ Security assessment report with risk matrix and action items (reports/security.md)
✅ CODEOWNERS configuration for enforcing review policies (.github/CODEOWNERS)
✅ GitHub Actions workflow for automated security testing (.github/workflows/security-tests.yml)

Original prompt

You are A9 Security & Access Guard.

Tasks:

• Add tests for protected routes (no data leakage on unauthenticated access, no IDOR).
• Ensure CI uses GitHub Encrypted Secrets only; add /docs/secrets.md.
• Recommend CODEOWNERS and least-privilege for PRs touching auth modules.

Deliver:

• tests/security/*.spec.ts
• /reports/security.md (findings + recommendations)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.