dashboard: add #harness + #harness-appendix sections (v3 design integration)

Redesign landing page: paper+ink visual system, instrumented pipeline, OWASP badges

feat(landing): OWASP coverage subtitle + LLM05 tooltip on corpus chips

fix(landing): align OWASP chip tooltips with actual defense paths

feat(landing): add OWASP security-demo chips to landing page

docs(landing): add OWASP mapping subtitle to Security panel

docs: step 8.1 — tagline reframe + README honest-scope + rename closure

feat(serving): Week 1 step 7 — showcase UI launch polish

fix: batch-3 adversarial review findings

feat: K8s corpus config entry, ingestion target, curation policy

feat: dashboard corpus selector, chip swap, chat tags

refactor: address batch-2 review feedback

feat: parameterized system prompt template

feat: SSE meta event carries corpus + corpus_label

feat: per-request corpus routing via Literal validation

security: fail-closed on secret extraction and env var leakage

refactor: address batch-1 review feedback

feat: multi-corpus construction with nested corpus×provider composition

feat: request log table with per-query health metrics

feat: runtime provider switching via dashboard toggle

fix: address 5 review issues in dashboard frontend

feat: showcase landing page with live RAG dashboard

fix: stream stage events live, thread source_chunks, fix LangChain wrapper

style: fix ruff lint — import sorting, line length

feat: route handler emits meta, injection, output_validation SSE events

fix: mypy errors — type annotations for pii_redactor, JSONResponse returns

fix: ruff lint — import sorting, unused imports, line length, naming

fix(security): buffer stream for output validation, store filtered answer

fix(security): output validation on /ask/stream, correct audit endpoint

fix(security): add security to /ask/stream, wire PII redactor into SearchTool

feat(security): wire injection detection, output validation, audit into pipeline

feat: infrastructure sprint — vLLM/Modal, Helm, Terraform (#8)

fix: propagate LLM cost from run_stream to /ask/stream metrics

fix: /ask/stream parity with /ask, eliminate double LLM call

feat: replace JSON root endpoint with HTML landing page

feat: add SQLite conversation sessions with session_id

feat: add streaming responses via SSE endpoint

feat: add self-documenting root endpoint

feat: switch deployment to Hugging Face Spaces (16GB free tier)

fix: skip startup warmup in production to avoid OOM on 512MB

feat: Render deployment config, startup warmup, README update

feat: add provider retry with backoff and API rate limiting

feat: add cross-encoder reranking with feature flag

feat: add grounded refusal gate based on retrieval score threshold

fix: handle OpenAI rate limit / quota errors as 503 instead of 500

fix: cross-request state bleed, metadata accuracy, empty question validation

feat: Day 6 — serving layer with FastAPI app, routes, middleware