key_store: try both Supabase download endpoint forms for robustness

Add encrypted per-browser API-key persistence (Supabase + invisible cookie tag, fail-safe)

Fix: propagate session-only API key to background worker threads (proposal/analysis generation)

Deploy app: Docker Space, session-only API keys, cloud file-upload dossier