fix(api): validate rolePresets with RolePresetsSchema before DB cast

Replace z.array(z.unknown()) with RolePresetsSchema for blueprint
role presets mutation input, ensuring structural validation before
Prisma JSON cast. Also adds SECURITY.md for vulnerability disclosure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/api/src/router/blueprint-support.ts

@@ -30,23 +30,23 @@ export async function findBlueprintByIdentifier<TBlueprint>(
 ): Promise<TBlueprint> {
   const normalizedIdentifier = identifier.trim();
 
-  let blueprint = await db.blueprint.findUnique({
+  let blueprint = (await db.blueprint.findUnique({
     where: { id: normalizedIdentifier },
     ...extraArgs,
-  }) as TBlueprint | null;
+  })) as TBlueprint | null;
 
   if (!blueprint) {
-    blueprint = await db.blueprint.findFirst({
+    blueprint = (await db.blueprint.findFirst({
       where: { name: { equals: normalizedIdentifier, mode: "insensitive" } },
       ...extraArgs,
-    }) as TBlueprint | null;
+    })) as TBlueprint | null;
   }
 
   if (!blueprint) {
-    blueprint = await db.blueprint.findFirst({
+    blueprint = (await db.blueprint.findFirst({
       where: { name: { contains: normalizedIdentifier, mode: "insensitive" } },
       ...extraArgs,
-    }) as TBlueprint | null;
+    })) as TBlueprint | null;
   }
 
   if (!blueprint) {
@@ -91,7 +91,7 @@ export function buildBlueprintUpdateData(
 }
 
 export function buildBlueprintRolePresetsUpdateData(
-  rolePresets: unknown[],
+  rolePresets: readonly Record<string, unknown>[],
 ): Prisma.BlueprintUncheckedUpdateInput {
   return {
     rolePresets: rolePresets as unknown as Prisma.InputJsonValue,