Critical:
- #1 Shell escape API key values in community-tools.env export
- #2 Replace ComputeNode.exec() with ComputeNode.run() (correct method)

High:
- #3 Add path traversal validation in status endpoint
- #4 Sanitize SSH user/host to prevent shell injection
- #5 Use i18n key for "Auto Research" sidebar button
- #6 Add Auto Research button to mobile sidebar
- #10 Stop leaking error.message to clients in 500 responses

Critical:
- #1 Shell escape API key values in community-tools.env export
- #2 Replace ComputeNode.exec() with ComputeNode.run() (correct method)

High:
- #3 Add path traversal validation in status endpoint
- #4 Sanitize SSH user/host to prevent shell injection
- #5 Use i18n key for "Auto Research" sidebar button
- #6 Add Auto Research button to mobile sidebar
- #10 Stop leaking error.message to clients in 500 responses

…r fixes

Fixes for PR OpenLAIR#146 review by @Zhang-Henry:

Critical:
- OpenLAIR#1: memory_enabled is now per-user (column on users table) instead of
  global app_settings. Each user controls their own memory toggle.
- OpenLAIR#2: ~/.claude/MEMORY.md namespaced as MEMORY-{userId}.md to prevent
  multi-user overwrites on shared servers.

High:
- OpenLAIR#3: req.params.id validated as positive integer with parseInt + isNaN guard
- OpenLAIR#4: Memory content sanitized (strip markdown headings) before prompt injection;
  content length capped at 500 chars; max 50 memories per user
- OpenLAIR#5: Content length validation (400 error) on create and update routes
- OpenLAIR#6: Delete now requires window.confirm() before executing

Medium:
- OpenLAIR#8: Removed no-op try/catch wrappers from all memoryDb methods
- OpenLAIR#9: Added comment explaining why Gemini injects memory into user prompt
  (CLI has no system instruction API)
- OpenLAIR#10: Changed index from (is_enabled) to composite (user_id, is_enabled)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>