feat: implement caching, rate limiter, and security headers (CSP) for decoupled deploy

chore: handle missing client dist path gracefully in server

chore: disable EventSub listener in server

feat: prepare transition to decoupled hosting (Render + Netlify + Supabase)