Security principles
- Service role keys must only exist in backend/bot environments and never in browser code.
- Dashboard actions must remain protected by Discord authentication and workspace permissions.
- Production deployments should disable dev-only tools and keep beta access limited until smoke tests pass.