auth: add email + password signup/login alongside OAuth

security: top-5 audit findings — auth namespacing, SSRF guard, OAuth URL hygiene, rate limit, CSP

security: harden backend — session secret, auth, SSRF, rate limits, timeouts

fix: remove edited/original badges, coerce Turso integer types

feat: GDPR marketing consent — banner, DB column, admin filter by consented users

fix: switch Turso from libsql-experimental to httpx HTTP API — zero new deps, builds on HF Spaces

feat: Turso dual-driver — persistent DB in prod, SQLite fallback for local dev

feat: knowledge base backend — SQLite DB, projects CRUD, experience enrichment, contradiction detection