fix: complete audit security and frontend gaps

apps/web/e2e/project-workbench.spec.ts

@@ -7,3 +7,11 @@ test('project workbench shell renders', async ({ page }) => {
   await expect(page.getByLabel('服务器 IP 或域名')).toBeVisible();
   await expect(page.getByLabel('项目总览')).toBeVisible();
 });
+
+test('inbox suggestions require explicit confirmation', async ({ page }) => {
+  await page.goto('/');
+  await page.getByLabel('选择 跟进报价').check();
+  await page.getByRole('button', { name: '创建选中项' }).click();
+
+  await expect(page.getByText('已选择 1 项')).toBeVisible();
+});