feat: wire frontend to real API, ship plots, multi-stage Docker build

feat: HF Space replay backend — trace store, /api endpoints, Docker, Cell 9

fix: use huggingface_hub.login() before LoRA download to fix 401

fix: pre-download SecAlign LoRA before vLLM init to avoid 401 in subprocess

fix: dtype kwarg (torch_dtype deprecated), vLLM max_model_len=4096

fix: max_completion_length 512→128, firewall circuit-breaker

fix: skip Unsloth in GRPO trainer (grpo_accumulated_loss signature mismatch)

Phase 4: InjectArenaEnv + FastAPI server + Dockerfile + env tests (81 passing)

fix: FirewallWrapper falls back to pg2 instance when llamafirewall scanner fails

fix: LlamaFirewall async handling + conditional AgentAlignment (TOGETHER_API_KEY)

fix: SecAlign fallback uses transformers+4bit instead of vLLM (T4 CUDA init conflict)

fix: PG2 label check — model returns LABEL_0/LABEL_1, not MALICIOUS/BENIGN

Phase 3: defense wrappers + Colab smoke/benchmark cells

Phase 2: verifiers, embedding cache, reward function

Phase 1: schemas, safety filter, scenario bank

Phase 0: bootstrap