- policies.html: sezione 'Allegati' nel dettaglio policy (Bootstrap Italia card), upload (entity_type=policy) via /api/audit/evidence/upload, lista con download/autore/data - AuditController::uploadEvidence: allowlist estensioni server-side (anti stored-XSS same-origin) - version.json -> 1.23.5 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>