feat: implement caching, rate limiter, and security headers (CSP) for decoupled deploy

chore: handle missing client dist path gracefully in server

chore: set Hugging Face app_port to 3000 in server/README.md

chore: disable EventSub listener in server

fix: polyfill WebSocket for Supabase client on Node.js 20 and add Hugging Face metadata

feat: prepare transition to decoupled hosting (Render + Netlify + Supabase)