security: CORS preflight, session invalidation, CSRF on preview, symlink containment, and hardening

- Add OPTIONS /api/volumen/* for CORS preflight (S-22).
- Invalidate session in require_login! when user no longer exists (S-8).
- Add check_csrf! to POST /admin/preview (S-1).
- Use File.realpath for symlink-safe containment in media_file (S-2).
- Memoize Users#all with mtime-based invalidation (S-12).
- Document that empty permitted_hosts means allow-all (S-5).
- Warn and fall back to random when session_key is too short (S-20).

CHANGELOG.md

@@ -24,6 +24,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `content_dir/<lang>/` instead of overwriting root-level files.
 - CLI test coverage (version, help, unknown command, option parsing, config bootstrap).
 - Test coverage for RSS feed and sitemap endpoints.
+- CORS preflight (`OPTIONS /api/volumen/*`) so browsers can reach the JSON API.
+- `Users#all` memoization with mtime-based invalidation, matching Store#all.
+- Session invalidation: deleted users can no longer use existing session cookies.
+- CSRF protection on `POST /admin/preview`.
+- Symlink-safe containment in `Store#media_file` via `File.realpath`.
 
 ### Changed
 
@@ -39,6 +44,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Draft posts no longer leak through the public detail endpoint (`/api/volumen/posts/:slug`).
 - `Config::DEFAULTS` inner hashes are now frozen and `deep_merge` builds fresh
   copies, preventing mutation from silently poisoning later `Config.load` calls.
+- A warning is emitted when `admin.session_key` is configured but shorter than
+  64 bytes, instead of silently falling back to a random secret.
 
 ## [0.1.0] — 2026-06-20