fix(#411): complete 2026-02-17 remediation sweep

Apply RLS context at task service boundaries, harden orchestrator/web integration and session startup behavior, re-enable targeted frontend tests, and lock vulnerable transitive dependencies so QA and security gates pass cleanly.

apps/web/src/components/widgets/AgentStatusWidget.tsx

@@ -5,7 +5,6 @@
 import { useState, useEffect } from "react";
 import { Bot, Activity, AlertCircle, CheckCircle, Clock } from "lucide-react";
 import type { WidgetProps } from "@mosaic/shared";
-import { ORCHESTRATOR_URL } from "@/lib/config";
 
 interface Agent {
   agentId: string;
@@ -29,7 +28,7 @@ export function AgentStatusWidget({ id: _id, config: _config }: WidgetProps): Re
       setError(null);
 
       try {
-        const response = await fetch(`${ORCHESTRATOR_URL}/agents`, {
+        const response = await fetch("/api/orchestrator/agents", {
           headers: {
             "Content-Type": "application/json",
           },