fix for hf deployment

chore: harden security defaults and admin auth handling

feat: migrate runtime to embedded sqlite/chroma and refresh ops

Start Phase 3 with admin auth and request observability

Phase 1 hardening and Phase 2 idempotent ingest foundation