fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

⭐5 — 4 achados STILL-REAL de advisories de segurança, cada um com TDD (RED→GREEN) e crédito ao reporter original: ACP RCE hardening (resolveVersionProbe), db-backups Tier-2 allowlist, uppercase authz bypass (matcher case-insensitive), spawn-veto drift (chatgpt-web-codex-doctor). typecheck/lint limpos, suíte authz/acp/cors verde. UNSTABLE é o base-red inherited #9985, já documentado no corpo da PR.

src/proxy.ts

@@ -24,6 +24,14 @@ export async function proxy(request: NextRequest) {
   return runAuthzPipeline(request, { enforce: true });
 }
 
+// Next compiles the middleware/proxy matcher from `regexp.source` only, dropping
+// path-to-regexp's default case-insensitive flag — so a lowercase literal like
+// `/v1/:path*` never matches `/V1/...`, while the rewrite matcher (flag kept)
+// still routes it to the handler. That skipped the authz pipeline entirely
+// (GHSA-jvqc-mp9f-q936). Expressing the case-insensitivity inside a custom
+// path-to-regexp group (`([vV]1)`) survives the flag-drop because it needs no
+// flag. Keep these in sync with the client-API aliases in
+// next.config.mjs rewrites and src/server/authz/classify.ts.
 export const config = {
   matcher: [
     "/",
@@ -31,15 +39,15 @@ export const config = {
     "/home",
     "/home/:path*",
     "/api/:path*",
-    "/v1/:path*",
-    "/v1",
-    "/v1beta/:path*",
-    "/v1beta",
-    "/chat/:path*",
-    "/responses/:path*",
-    "/responses",
-    "/codex/:path*",
-    "/codex",
-    "/models",
+    "/:v1seg([vV]1)/:path*",
+    "/:v1seg([vV]1)",
+    "/:v1betaseg([vV]1[bB][eE][tT][aA])/:path*",
+    "/:v1betaseg([vV]1[bB][eE][tT][aA])",
+    "/:chatseg([cC][hH][aA][tT])/:path*",
+    "/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])/:path*",
+    "/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])",
+    "/:codexseg([cC][oO][dD][eE][xX])/:path*",
+    "/:codexseg([cC][oO][dD][eE][xX])",
+    "/:modelsseg([mM][oO][dD][eE][lL][sS])",
   ],
 };