fix: CORS in create_app factory, clean main.py

feat: live stat audit API working — detects p-hacking, small samples, critical risk scoring

feat: statistical audit engine with 7 tests — all passing

feat: SciPeerAI project foundation initialized