Harden localbrain security defaults

[michaelzenkay]

What changed

• replace Edge Function service-role access with the local anon key and least-privilege RLS
• make the normal MCP bridge read-only and add an explicit local CLI for user-initiated captures
• disable update/delete by default and deny direct anon insert/update/delete privileges
• wrap retrieved memory and metadata as untrusted content and add input bounds
• require header-only access keys
• add loopback Docker networking, Windows firewall and ACL hardening, on-demand lifecycle controls, and loopback-only Ollama publishing
• rewrite the README and supporting docs around the hardened setup and trust boundaries

Why

Docker Desktop published ports were not reliably restricted to loopback, and the previous MCP function held a service-role key while allowing every connected agent to capture, update, and delete memories. Retrieved memories could also carry prompt-injection text without a clear trust boundary.

Impact

MCP clients can search and list memories but cannot write. Users capture explicitly with node scripts/localbrain-cli.mjs capture .... Existing installs must apply the new migration, switch .env from SUPABASE_SERVICE_ROLE_KEY to SUPABASE_ANON_KEY, and install the Windows firewall rule before the hardened startup helper will run.

Validation

• Deno type check passed with the repository import map
• Node syntax checks passed for both bridges/CLIs
• all PowerShell scripts parsed successfully
• git diff --check passed
• public-tree secret and machine-path regex scan passed
• both migrations applied to an isolated Supabase Postgres container
• anon capture RPC succeeded in isolation
• verified anon table privileges: select=true, insert=false, update=false, delete=false

A live Ollama/Edge Function smoke test was not run in the public checkout because startup intentionally requires the administrator-installed local firewall rule.