feat(config): add evaluation.judge_dimensions field

feat: evaluate.py --corpus flag + CorpusConfig.golden_dataset

fix: batch-3 adversarial review findings

security: fail-closed on secret extraction and env var leakage

refactor: address batch-1 review feedback

feat: add CorpusConfig for multi-corpus support

fix(security): validate injection tier names, normalize URLs

fix(security): rotation collision, HMAC IP hashing, Literal config enums

feat(security): add security config models to AppConfig

feat: infrastructure sprint — vLLM/Modal, Helm, Terraform (#8)

feat: add SQLite conversation sessions with session_id

fix: production config with reranker disabled for 512MB free tier

feat: add provider retry with backoff and API rate limiting

feat: add cross-encoder reranking with feature flag

feat: add grounded refusal gate based on retrieval score threshold

fix: address Day 1 audit findings

feat: Day 1 — repo scaffolding, provider abstraction, config, tests