feat(security): standardized security event model

[nitinawari]

Summary

Implements a standardized security event model with 8 categories, built on the existing event pipeline (Redis → CTFEvent).

• Adds finbot/security/ — schema, emitter, and category helpers
• Emits agent.security.<category> with event_subtype=security
• Dual-emit for tools and guardrails so existing CTF detectors and activity UI keep using tool_call_* / agent.guardrail.*
• No database migrations (payload stored in existing ctf_events.details JSON)

Security event categories

Category	When emitted
prompt_goal_change	Agent task start, chat user message, orchestrator delegation
memory_read	agent_notes loaded into agent/LLM context
memory_write	agent_notes mutations in data tools
tool_selection	LLM selects a tool (base.py, chat.py)
tool_parameters	Tool invocation (dual-emit with tool_call_start / mcp_tool_call_start)
tool_output	Tool completion (dual-emit with tool_call_success / failure)
authorization_decision	Vendor portal scope checks; FinMail/FinDrive admin deny paths
guardrail_trigger	Guardrail webhook hooks (dual-emit with legacy agent.guardrail.*)

Key files

• finbot/security/ — schemas.py, emitter.py, memory.py, prompt.py, tools.py, authorization.py, mappings.py
• Wiring: agents/base.py, chat.py, orchestrator.py, utils.py, mcp/provider.py, apps/vendor/routes/api.py, MCP servers, guardrails/service.py
• Tests: tests/unit/security/ (8 test modules)

Test plan

• pytest tests/unit/security/ -v
• Manual smoke: agent run logs show security.memory_read, tool_selection, tool_parameters, tool_output

GSoC mapping

Week 3-4 (phase 2)

• Deliverable A.2 : A standardized security event model for: prompt/goal changes, memory read/write, tool selection, tool parameters, tool outputs, privilege/authorization decisions, and guardrail triggers.