fix: lazy DB init so backend starts even if DATABASE_URL not set on HF

fix: remove rate limiter decorator causing 500, add error details and ping endpoint

feat: deploy — email/password only auth, no OAuth buttons