Opening this demo for the public

fix(auth): require X-API-Key header on all /api/* routes

Add per-file upload spinners, wire Validar todo, and poll analysis status

feat: build Python backend and connect React UI to real API