security: sync CORS and error handling security updates in main repo

feat: adjust center group threshold to 250 for chat words

fix: add pagination to unpaginated Supabase queries to bypass 1000 row limit

fix: scale down word cloud rendering for low absolute frequency words

fix: enforce mobile 1-col layout and prevent horizontal blowout

fix: resolve mobile layout swipe and word cloud scaling

style: make dashboard layout responsive for mobile devices

chore: add Google Search Console verification meta tag

feat: implement caching, rate limiter, and security headers (CSP) for decoupled deploy

chore: replace Render reference with generic cloud server reference in loading screen

fix: use fully qualified API_BASE for avatar proxy requests

chore: handle missing client dist path gracefully in server

chore: set Hugging Face app_port to 3000 in server/README.md

chore: add netlify.toml to specify base directory for building client

chore: disable EventSub listener in server

fix: polyfill WebSocket for Supabase client on Node.js 20 and add Hugging Face metadata

perf: optimize stats polling and add React ErrorBoundary for frontend crash fallback

feat: prepare transition to decoupled hosting (Render + Netlify + Supabase)