[verified] Security hardening + UX/UI polish

Security (requesting-code-review pipeline + independent reviewer):
- Fix path traversal on file upload (basename sanitize + resolve-containment)
- Fix IDOR: org + owner scoping on all group/chat routes (_authorize_group/_get_owned_group),
  hide other users' personal groups in listings
- Remove XSS via v-html in Chat task (text interpolation)
- Add test_security.py (traversal + cross-user denial) — all pass

UX/UI (ui-ux-pro-max + frontend-dev-verification):
- Global: focus rings, 44px touch targets, hover/press transitions, input focus glow,
  prefers-reduced-motion, skeleton loaders, empty states, back links, spinner
- Login: password toggle, autocomplete, spinner, disabled-when-empty
- Cards lift on hover; dashboard skeleton + empty state; analyze button spinner

All backend tests pass (m0/m1/routes/security/e2e); frontend builds; served SPA verified via curl.

backend/app/api/chat_routes.py

@@ -27,14 +27,28 @@ def _sim(group, persona):
     return Simulator(llm)
 
 
+def _get_ready_group(s, gid: str) -> dict:
+    """Org-scoped group access for trainees + require ready status (IDOR defense)."""
+    group = s["groups"].get_or_none(gid)
+    if not group or group.get("status") != "ready":
+        raise ApiError("group not ready", 404)
+    actor = current_user()
+    # super_admin can access any; otherwise owner (for personal groups) + same org.
+    owner = group.get("owner_user_id")
+    if actor.get("role") != "super_admin":
+        if owner and owner != actor["id"]:
+            raise ApiError("permission denied", 403)
+        if group.get("org_id") != actor.get("org_id"):
+            raise ApiError("permission denied", 403)
+    return group
+
+
 @chat_bp.post("/<gid>/personas/<pid>/chat/start")
 @require_auth
 @require_roles("user")
 def start_session(gid: str, pid: str):
     s = _stores()
-    group = s["groups"].get_or_none(gid)
-    if not group or group.get("status") != "ready":
-        raise ApiError("group not ready", 404)
+    group = _get_ready_group(s, gid)
     persona = s["groups"].get_persona(gid, pid)
     if not persona:
         raise ApiError("persona not found", 404)
@@ -87,7 +101,9 @@ def send_message(gid: str, pid: str):
         raise ApiError("message too long")
 
     group = s["groups"].get_or_none(gid)
-    persona = s["groups"].get_persona(gid, pid)
+    persona = s["groups"].get_persona(gid, pid) if group else None
+    if not group or not persona:
+        raise ApiError("session context missing", 404)
     messages = list(session.get("messages", []))
     messages.append({"role": "seller", "text": text})