v4.0.3 — Security scan fix: align resource names with scripts

[Jovancoding]

v4.0.3 — Security scan fix: align resource names with scripts

Body:

## What's Fixed

### OpenClaw Scanner: Suspicious → Clean

The previous release was flagged **Suspicious / MEDIUM CONFIDENCE** by the OpenClaw security scanner due to a mismatch between `SKILL.md` documentation and the actual Python scripts.

**Root cause:** `SKILL.md` and `references/auth-guardian.md` referenced resource names `SAP_API`, `FINANCIAL_API`, `EXTERNAL_SERVICE`, and `DATA_EXPORT`. The scanner interpreted these as claims of gating real external APIs without any credential requests.

**Reality:** `check_permission.py` uses abstract local resource type names: `DATABASE`, `PAYMENTS`, `EMAIL`, `FILE_EXPORT`. No external APIs, no credentials — all permission evaluation runs locally.

**Fix:** All documentation now matches the scripts exactly.

| Old (misleading) | Actual (script) |
|------------------|-----------------|
| `SAP_API` | `DATABASE` |
| `FINANCIAL_API` | `PAYMENTS` |
| `EXTERNAL_SERVICE` | `EMAIL` |
| `DATA_EXPORT` | `FILE_EXPORT` |

Added explicit note across `SKILL.md` and `references/auth-guardian.md`:
> All permission evaluation is local. No external credentials are required or used.

### Also fixes in this patch series (4.0.1 → 4.0.3)
- **ReDoS** (CodeQL #79): replaced `/\/+$/` regex in `McpSseTransport` with a safe string loop
- **Unused imports** (CodeQL #80, #81): removed stale `ParallelLimitError` and `BlackboardMCPTools` imports

### Tests
**1216 passing** — no regressions

https://github.com/jovanSAPFIONEER/Network-AI/blob/main/CHANGELOG.md

---

This discussion was created from the release v4.0.3 — Security scan fix: align resource names with scripts.