security: fix SSRF, add URL validation, fail2ban, and body size limit

feat: add two-tier render cache with S3-compatible storage

add stats dashboard at GET / and restrict deploy-hf triggers

initial release v0.1.0: headless browser rendering API