fix: remove broken _csrf_protection middleware, add Private-Network header

fix: demo login password hash + /b/:slug route

Deploy backend to HF Spaces