Stop shipping hard-coded demo docs/projects into production builds, drop local mock items on authoritative empty server lists, and purge stale demo seed residue from localStorage on boot. Co-authored-by: Cursor <cursoragent@cursor.com>
Add P0 negative tests, prod bundle forbidden-string scan, and the Phase 0 security止血 acceptance report with PASS results.