fix(backend): enable forbidNonWhitelisted, batch team split inserts, remove dead split math, and harden DTO/pipe/OAuth scopes (#170, #150, #127, #112, #111, #104, #98) - #181