Cover anonymous admin/task access, body limits, MIME rejection, strict readiness, and CORS allowlist without legacy test principals. Co-authored-by: Cursor <cursoragent@cursor.com>