🎯 Devkit June audit — remediation tracker

[PierreBrisorgueil]

🎯 Devkit June audit — remediation tracker

Umbrella for the deep-validated findings from the June 2026 internal audit (all non-dep changes since 2026-06-01; multi-agent review + adversarial re-validation).

Sub-issues:

• 🔒 updatePassword persists the new password in plaintext (+ self-lockout) #3925 — 🔒 updatePassword persists plaintext + self-lockout (Node, HIGH)
• 🐛 audit nits — requestJoin silent failure + uncommitted api.js helper Vue#4389 — 🐛 audit nits: requestJoin silent failure + uncommitted api.js (Vue, LOW)

Related (tracked elsewhere, not a sub-issue): the org-removal cascade erasure gap — billing onOrganizationRemoved handler + users.remove registry bypass — folds into the GDPR epic #3802 (see comments on #3889 + #3884).

Created via /dev:issue

[PierreBrisorgueil]

All sub-issues closed: Node#3925 (updatePassword hash, PR #3937) + Vue#4389 (requestJoin surface + untracked api.js deleted, PR #4397). June audit remediation complete.