persist: LS data dir -> /data (the mounted Storage Bucket)

bundle: refresh config with per-slot visibleWhen (hide unused C5-C12)

bump: label-studio 1.13.1 -> 1.23.0 (Django 4.2, modern CSRF format, latest fixes)

bundle: refresh label_studio_config.xml with 'task has N constraints' header

fix(csrf): CSRF_TRUSTED_ORIGINS must be hostnames for Django 3.2 (LS 1.13.1 ships Django 3.2)

fix(csrf): SameSite=None on cookies so iframe POSTs from huggingface.co/spaces/... carry csrftoken

fix(dockerfile): locate LS settings via find, not import (avoids PYTHONPATH issue)

fix(csrf): append proxy-aware overrides directly into LS settings at build time

cleanup: drop ls_proxy_settings.py (replaced with build-time patch)

fix: pre-seed SENTRY_DSN so init_sentry doesn't AttributeError during settings load

fix(csrf): overlay ls_proxy_settings.py to set SECURE_PROXY_SSL_HEADER (LS 1.13.1 doesn't read it from env)

fix(csrf): honour X-Forwarded-Proto + add *.hf.space to trusted origins

fix: trust *.hf.space origin so /user/login/ form POST passes Django CSRF

bootstrap: Label Studio + canonical Multi-Turn task bundle

initial commit