Component: finbot/mcp/servers/systemutils/server.py → read_config
Root cause: Same as Bug_173 — no filepath allowlist.

Steps to reproduce:

1. Call read_config(filepath='.env')

Expected: error — .env path not in permitted allowlist
Actual: mock config content returned

How to execute:

pytest tests/unit/mcp/test_systemutils.py::TestReadConfig::test_su_cfg_003_env_file_accepted_without_validation -v

Proposed fix: Same as Bug_173 — .env is not in ALLOWED_PATHS. This test passes once Bug_173's fix is applied.

Impact: .env files commonly contain credentials, API keys, and database passwords. Accepting this path trains the LLM to expect credential content from config reads.
Acceptance criteria:

• test_su_cfg_003_env_file_accepted_without_validation passes (exception raised for .env)
• test_su_cfg_001_returns_expected_fields continues to pass