fix: serve frontend static files and use relative /upload route

feat: upload security hardening + frontend rebuild

fix: replace opencv with headless version to fix mediapipe conflict

feat: add face landmarker model via git lfs

feat: initial deployment setup