GT AI OS Community Edition v2.0.33

Security hardening release addressing CodeQL and Dependabot alerts:

- Fix stack trace exposure in error responses
- Add SSRF protection with DNS resolution checking
- Implement proper URL hostname validation (replaces substring matching)
- Add centralized path sanitization to prevent path traversal
- Fix ReDoS vulnerability in email validation regex
- Improve HTML sanitization in validation utilities
- Fix capability wildcard matching in auth utilities
- Update glob dependency to address CVE
- Add CodeQL suppression comments for verified false positives

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

scripts/migrations/013_rename_cost_columns.sql

@@ -0,0 +1,15 @@
+-- Migration 013: Rename cost columns from per_1k to per_million
+-- This is idempotent - only runs if old columns exist
+
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM information_schema.columns
+               WHERE table_name = 'model_configs'
+               AND column_name = 'cost_per_1k_input') THEN
+        ALTER TABLE model_configs RENAME COLUMN cost_per_1k_input TO cost_per_million_input;
+        ALTER TABLE model_configs RENAME COLUMN cost_per_1k_output TO cost_per_million_output;
+        RAISE NOTICE 'Renamed cost columns from per_1k to per_million';
+    ELSE
+        RAISE NOTICE 'Cost columns already renamed or do not exist';
+    END IF;
+END $$;