fix: restore security hardening compatibility and validation

Restore authorized rule reveal, explicit full HTTP capture and retention, video task business fields, and valid payment URLs. Add opt-in credential preservation for trusted recovery, fix frontend type contracts and async races, and eliminate PostgreSQL test fixture resource leaks. Document audit coverage and successful fmt and CI-scoped Clippy checks.

frontend/src/components/ui/select.vue

@@ -4,7 +4,7 @@ import { SelectRoot as SelectRootPrimitive } from 'radix-vue'
 
 interface Props {
   defaultValue?: string
-  modelValue?: string
+  modelValue?: string | null
   open?: boolean
   defaultOpen?: boolean
   dir?: 'ltr' | 'rtl'
@@ -35,7 +35,7 @@ const openProp = computed(() =>
 
 // modelValue 未传入时不绑定，让 radix-vue 走 uncontrolled 模式
 const modelValueProp = computed(() =>
-  props.modelValue !== undefined ? { modelValue: props.modelValue } : {}
+  props.modelValue !== undefined ? { modelValue: props.modelValue ?? '' } : {}
 )
 </script>