fix(security): re-auth on DB export/import + SSRF guard on web fetch

- /api/settings/database now requires current password (header for GET,
  body for POST) in addition to session; CLI-token requests exempt
- add verifyDashboardPassword helper reusing login bcrypt check
- profile UI prompts password via modal before export/import
- /v1/web/fetch rejects internal/private/metadata targets via assertPublicUrl

Refs GHSA-qvfm-67h2-2qfx, GHSA-qj3v-64wj-q825

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/settings/database/route.js

@@ -1,9 +1,21 @@
 import { NextResponse } from "next/server";
 import { exportDb, getSettings, importDb } from "@/lib/localDb";
 import { applyOutboundProxyEnv } from "@/lib/network/outboundProxy";
+import { verifyDashboardPassword } from "@/lib/auth/dashboardSession";
 
-export async function GET() {
+const CLI_TOKEN_HEADER = "x-9r-cli-token";
+const PASSWORD_HEADER = "x-9r-password";
+
+// CLI token requests are already trusted (local machine); skip password re-auth.
+function isCliRequest(request) {
+  return Boolean(request.headers.get(CLI_TOKEN_HEADER));
+}
+
+export async function GET(request) {
   try {
+    if (!isCliRequest(request) && !(await verifyDashboardPassword(request.headers.get(PASSWORD_HEADER)))) {
+      return NextResponse.json({ error: "Invalid password" }, { status: 401 });
+    }
     const payload = await exportDb();
     return NextResponse.json(payload);
   } catch (error) {
@@ -14,7 +26,10 @@ export async function GET() {
 
 export async function POST(request) {
   try {
-    const payload = await request.json();
+    const { password, ...payload } = await request.json();
+    if (!isCliRequest(request) && !(await verifyDashboardPassword(password))) {
+      return NextResponse.json({ error: "Invalid password" }, { status: 401 });
+    }
     await importDb(payload);
 
     // Ensure proxy settings take effect immediately after a DB import.