feat(security): enforce IP quotas, harden claims, and tighten API limits

increased security

test(auth): express unconfigured state via empty env var, not delenv

feat(media): emit /media proxy paths, carry bearer header on client media fetches

feat(media): owner-checked /media/{card_id}/{filename} proxy over private HF dataset

Merge branch 'presenter-natural-tour' into backend-auth-quotas

feat: on-device AI backend round-trip (bundle persist + fetch + structure upload)

feat: admin token gate, clean 500s, restricted CORS

feat: /auth/claim legacy library migration (first-claim-wins)

feat: quotas wired — chat 429s, cards degrade, /me/quota

feat: usage table + daily quota accounting

feat: all data routes require verified owner identity

feat: verified Firebase identity dependency (get_owner)

test: per-test isolated DB + shared client fixture, health smoke test

stripped unnecessary stuff

fixed the db issues

added massive features "Feed" and "Serendipity"

added chatHistory.

fixed stuffff

refactor: remove HuggingFace as LLM backend; keep Cerebras→Groq chain

splash screen

fixed substack integration

increased the sources of input.

added collections

Action_items

somewhat works

Phase 1 done

frontend

Working Backend

docs