SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist (CVE-2026-54069) | HOL Guard CVE