fix(security): Phase 1 — SSRF eScriptorium + Tesseract lang + bandit nosec 3836b05 unverified Claude commited on May 13