feat: enhance OAuth flow validation and improve security checks; add credential read blocking and git operation safeguards

src/model/msglog/schema.rs

@@ -11,6 +11,7 @@ use anyhow::Result;
 ///
 /// Return: `Ok(())` on success, or the underlying SQLite error.
 pub fn init_schema(conn: &Connection) -> Result<()> {
+    conn.execute_batch("PRAGMA foreign_keys = ON;")?;
     conn.execute_batch(
         "
         CREATE TABLE IF NOT EXISTS messages (