connect frontend to HF Space backend, fix CORS default

fix: 5 bugs found in security and payment flow

feat: server-side payment enforcement with on-chain tx verification

refactor: remove Supabase/auth/paywall — no DB needed

Initial commit — Squint screenshot-to-code app