fix(api): validate rolePresets with RolePresetsSchema before DB cast

Replace z.array(z.unknown()) with RolePresetsSchema for blueprint
role presets mutation input, ensuring structural validation before
Prisma JSON cast. Also adds SECURITY.md for vulnerability disclosure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/api/src/router/blueprint-procedure-support.ts

@@ -1,4 +1,9 @@
-import { BlueprintTarget, CreateBlueprintSchema, UpdateBlueprintSchema } from "@capakraken/shared";
+import {
+  BlueprintTarget,
+  CreateBlueprintSchema,
+  RolePresetsSchema,
+  UpdateBlueprintSchema,
+} from "@capakraken/shared";
 import { z } from "zod";
 import { findUniqueOrThrow } from "../db/helpers.js";
 import { makeAuditLogger } from "../lib/audit-helpers.js";
@@ -54,7 +59,7 @@ export const blueprintUpdateInputSchema = z.object({
 
 export const blueprintRolePresetsInputSchema = z.object({
   id: z.string(),
-  rolePresets: z.array(z.unknown()).max(100),
+  rolePresets: RolePresetsSchema.max(100),
 });
 
 export const blueprintBatchDeleteInputSchema = z.object({