fix: serve frontend static files and use relative /upload route

feat: upload security hardening + frontend rebuild

fix: correct dist folder structure

fix: use relative URL for API calls

feat: initial deployment setup