Merge branch 'fix/encrypt-free-text-and-local-ai' into release/v1.39.3

# Conflicts:
#	src/app/api/import/csv/route.ts

.env.example

@@ -125,10 +125,15 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # Users bring their own API keys via Settings. No server-side key needed by
 # default. The admin can configure a fallback key in the Admin Panel.
 
-# Local-AI SSRF opt-in (optional). The local AI provider rejects private/
-# internal hosts by default. Set to an exact host allowlist (comma-separated,
-# e.g. "ollama.lan,10.0.0.5") or "true" for any private host — intended for a
-# self-hosted Ollama / LM Studio endpoint. See docs/integrations/ai-providers.md.
+# AI endpoints on your own network (optional). An AI base URL on a private
+# address is refused unless its exact origin is listed here, comma-separated
+# (e.g. "http://ollama.lan:11434,http://10.0.0.5:4000") — for a self-hosted
+# Ollama, LM Studio or LiteLLM gateway. Link-local, metadata and unspecified
+# addresses stay refused even when listed. See docs/integrations/ai-providers.md.
+# AI_PRIVATE_ORIGINS=""
+# Older form, kept for existing installs: an exact host list still works
+# (e.g. "ollama.lan,10.0.0.5"). "true" is deprecated: it now covers only the
+# admin AI key and admin accounts' own AI settings, and will be removed.
 # ALLOW_LOCAL_AI_PRIVATE_HOSTS=""
 
 # Daily-briefing output-token ceiling (optional). Default 2500, clamped to