Security Hardened HTTP response headers to reduce browser-side attack surface. Bug Fixes Fixed a rare race where bulk status changes could silently revert after reload.