SUM-SEC-20 [P2][20/20][Low] Require JSON Content-Type on RPC; keep Upsert internal-only

[CHINMAYVIVEK]

ID: SUM-SEC-20
Wave: P2
Severity: Low
Labels: security, rpc, orm, P2, low
Branch: fix/SUM-SEC-20-rpc-content-type-upsert-rules
Languages: Go, TypeScript (SWC note only)

Summary

1. RPC accepts empty Content-Type as JSON — loosens CSRF/browser quirks surface.
2. ORM Upsert skips CheckRecordRules (intentional). Safe only if never reachable from authenticated RPC; needs assert/guard.
3. SWC t-out / t-raw are XSS sinks if fed user HTML — prefer t-esc in mail/chatter templates (hardening note).

Acceptance criteria

• Require application/json (or documented charset variants) on /api/rpc
• Upsert: panic/error if called without bypass from non-internal path, or apply record rules for non-bypass
• Doc or lint note: no t-out on untrusted user content in addons
• Optional: keep SetEscapeHTML(true) on API JSON encoders

Files to check / change

• sumeru/core/server/web/rpc_json.go (~L87–89)
• sumeru/core/orm/crud_insert.go (Upsert)
• sumeru/core/server/web/auth_helpers.go (JSON encode escape)
• sumeru/core/swc/src/template/sum/codegen.ts (t-out / t-raw — documentation / review)