Drop app-level RELAY_SECRET; private Space + HF token is the auth

Harden: fail-closed+const-time auth, id validation, FILES_DIR reaper+trim, server size cap, copy-outside-lock, api_poll .get(), no analytics

Pin gradio 6.10.0 (fixes api-info bool bug from gr.File on 5.9.1); theme->launch

Add file transfer (push/pull, <=100MB); dropdown allow_custom_value

UI: skip no-op repaints to stop dropdown/output flicker