v1.2.0 - Security Fixes + Agentic QE Fleet

Security 🔒

• Critical CORS Fix: Replaced allow_origins=["*"] with explicit allowed domains
• JWT Security: Added 32-character minimum validation for secrets
• Rate Limiting: New RateLimiter class (5 req/min, 5-min lockout)
• Refresh Tokens: Access tokens 1h, refresh tokens 7 days
• Security Headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options

Added 🤖

• 18 specialized QE agents for comprehensive testing automation
• 59 quality engineering skills integrated with Claude Code
• AQE MCP server integration for tool coordination
• Quality Analysis Reports: Comprehensive code complexity, quality metrics, test doubles inventory

Fixed

• Backend test isolation with reset_rate_limiter()
• Frontend @testing-library/user-event upgrade v13→v14.5.2
• Docker build npm ci --only=production deprecation

Changed

• Claude-Flow v2.0.0 integration with enhanced hooks
• AQE v2.2.0 with native hooks (100-500x faster than external)
• Streamlined .claude/settings.json

Full Changelog

v1.1.0...v1.2.0