Advisory (low pri): enable auth_leaked_password_protection (HaveIBeenPwned check) in Supabase auth — currently disabled. Low value for Pluto (allowlist-only, no open signup) but a free defense-in-depth toggle. From PLUTO-123 security sweep.