fix(BACKEND-1): move rate limiter eviction AFTER current key pruning -- prevents losing rate-limit tracking on burst-after-idle patterns

fix(H-05): rate limiter eviction uses ts[0] (oldest) not ts[-1] (newest) -- prevents sliding window bypass attack

fix(NEW-A3 part1): replace em-dashes/smart-quotes in 56+ Python files -- CI requires pure ASCII source

fix(BUG-13/14): audit_logger uses per-process file; rate_limiter evicts stale windows

feat(security):complete — security hardening and provenance