Track the 5 open v1 security PRs (board #11 issues-only cleanup)

[cliffhall]

Summary

Five open security PRs target v1/main and are the last items still sitting on
project board #11 as PR cards. Board #11 is issues-only (see AGENTS.md →
Issue-driven Work Style), and the umbrella they each reference — #1819,
"go-live 7/9: triage and bulk-close the v1 PR backlog" — is closed, so
removing those cards would leave this work with no board tracking at all.

This issue is that tracking. The PR cards are being removed from #11; each PR
below is reachable from here.

The open PRs

PR	Issue addressed
#1189	OAuth callback does not validate the state parameter
#1190	Reverse tabnabbing via window.open with _blank (no noopener/noreferrer)
#1296	Proxy logs full connection request — sensitive env vars and headers unredacted (closes #847)
#1161	Requests with a missing Origin header bypass origin validation (CWE-346)
#1732	DNS-rebinding TOCTOU in safeProxyFetch — resolved IPs not pinned

All five are from outside contributors and predate the current
issues-not-PRs contribution policy.

What needs deciding

v1/main is in deprecated maintenance mode and accepts security fixes only —
which is exactly what these are. So each PR needs an explicit call:

• Security: OAuth callback does not validate state parameter #1189 — merge, or close with rationale
• Security: Potential reverse tabnabbing via window.open with _blank #1190 — merge, or close with rationale
• fix(server): redact sensitive env vars and headers from connection logs #1296 — merge, or close with rationale
• fix: reject requests with missing Origin header in origin validation middleware (CWE-346) #1161 — merge, or close with rationale
• fix: prevent DNS-rebinding TOCTOU in safeProxyFetch by pinning resolved IPs #1732 — merge, or close with rationale

If any are declined on security grounds, the closed-v1-security-declined
label exists for that. If v1's deprecation means none of them ship, say so
here and close them as a batch — the point is that the decision is recorded
rather than the PRs sitting open indefinitely.