Fix: disable Streamlit XSRF and CORS protection for HF Spaces file upload

Route all logs to stdout/stderr for HF Spaces visibility

Add Dockerfile and supervisord config for HuggingFace Spaces deployment