harden: strict Bearer-only, sampled deprecation, CORS fix, tests

feat: accept HF token via Authorization header (keep Query as deprecated fallback)

fix: forward endSession reason through handle_end_session

fix: release session lock on peer disconnect + missing status import

Add /api/robot-status endpoint for passive busy/app queries

Add concurrency gate: reject new sessions while robot is busy

Add owner-based filtering and rate limiting for security

Switch from WebSocket to SSE+HTTP for browser compatibility

Add first-message auth for browser WebSocket clients

Remove hf_oauth - server has its own auth

Add CORS middleware for browser clients

Fix WebSocket close before accept and add connection logging

Trigger rebuild

Enable HF OAuth + accept Bearer token in headers

Support HF proxy auth for logged-in users

Fix list response format for GStreamer compatibility

Fix: remove __pycache__ and add .gitignore

Add HuggingFace token authentication

Add WebRTC signaling server for baby camera

initial commit