network-ai ApprovalInbox Missing Authentication and Wildcard CORS

The ApprovalInbox HTTP server in network-ai <=5.11.0 has no authentication and sets Access-Control-Allow-Origin: *, allowing any website or local process to enumerate and approve/deny pending high-risk actions without credentials.

All users of network-ai <=5.11.0 who use the ApprovalInbox feature (opt-in, but documented as a security measure).

Upgrade to [email protected] or later, which requires a bearer secret for mutating endpoints and removes the wildcard CORS.