Mejoras
Report share links now need a secret and can be revoked
Shared reports use REPORT_SHARE_SECRET only, owners/admins/editors can revoke them, and the public page is rate-limited.
Creating or opening a share link now fails closed if REPORTSHARESECRET is unset — there is no fallback to TOKENVAULTSECRET or a dev default. Only workspace owners, admins, and editors can create a link, and they can revoke it. The public report endpoint is rate-limited and loads only that report type. Inbox/response reports count unanswered inbound with isfromme, which exists in production.