[madhavkhoslaa]

Summary

This PR applies the security audit fixes for the CLI surface.

Key fixes

• Enforce path containment for build.dir and store files/media (including symlink escape checks).
• Add API URL validation and token-safety controls (--allow-custom-api, --allow-insecure-http, env equivalents).
• Replace infinite HTTP client timeout with a bounded timeout.
• Add trusted template-source guard for create --from with explicit override flag.
• Harden self-update and installer flows with stricter source/asset validation.
• Add upload URL validation in chunk delivery flow (scheme/host/public constraints).
• Update LLM docs for changed flags/behavior.

Validation

• go test ./... passes.