[verified] Security hardening + UX/UI polish

Security (requesting-code-review pipeline + independent reviewer):
- Fix path traversal on file upload (basename sanitize + resolve-containment)
- Fix IDOR: org + owner scoping on all group/chat routes (_authorize_group/_get_owned_group),
  hide other users' personal groups in listings
- Remove XSS via v-html in Chat task (text interpolation)
- Add test_security.py (traversal + cross-user denial) — all pass

UX/UI (ui-ux-pro-max + frontend-dev-verification):
- Global: focus rings, 44px touch targets, hover/press transitions, input focus glow,
  prefers-reduced-motion, skeleton loaders, empty states, back links, spinner
- Login: password toggle, autocomplete, spinner, disabled-when-empty
- Cards lift on hover; dashboard skeleton + empty state; analyze button spinner

All backend tests pass (m0/m1/routes/security/e2e); frontend builds; served SPA verified via curl.

frontend/src/views/GroupEdit.vue

@@ -1,13 +1,19 @@
 <template>
   <div>
+    <router-link to="/" class="btn-back">← {{ i18n.t('dashboard') }}</router-link>
     <div class="row" style="align-items:center;margin-bottom:16px">
       <h2 style="margin:0">{{ i18n.t('groupBuilder') }} — {{ group && group.title }}</h2>
       <button class="primary" style="margin-left:auto" @click="analyze" :disabled="busy">
-        {{ busy ? '...' : i18n.t('analyze') }}
+        <span v-if="busy" class="spinner" style="margin-right:4px"></span>{{ i18n.t('analyze') }}
       </button>
     </div>
     <div class="error" v-if="error">{{ error }}</div>
 
+    <div v-if="personas.length === 0 && !busy" class="card empty-state">
+      <strong>No personas yet</strong>
+      <span>Click {{ i18n.t('analyze') }} to generate the 15 personas (5 per tier).</span>
+    </div>
+
     <div v-for="tier in ['A','B','C']" :key="tier" style="margin-bottom:20px">
       <h4>{{ tierLabel(tier) }}</h4>
       <div class="grid">