Fail closed empty allowlist

Editor assessment

This commit patches CVE-2026-31998. The header `fix(synology-chat): fail closed empty allowlist` captures the security semantics in a single phrase: an empty allowlist now denies access instead of permitting it. The integration scope is precise and the type fits a defensive correction. The compressed grammar (`fail closed empty allowlist`) takes a second read, and there is no body to spell out the old fail-open behavior, which deployments were exposed, or how the empty case is now detected. Still, the subject alone communicates the change's intent, which is more than most one-line fixes manage. No footers or punctuation problems are present, so it remains a solid, publishable entry.