Switch to live mode by default, fixtures become fallback only

Fix remaining issues: SSRF hardening, CORS lockdown, test isolation

Add CI pipeline, ruff/mypy config, and fix all lint issues

Fix critical bugs, security vulnerabilities, and UX issues

feat(frontend): implement lot 3 minimal Mirador reading workspace