Bump torch to 2.6 (transformers requires it for torch.load, CVE-2025-32434)

Disable XSRF/CORS so file uploads work behind HF proxy

Deploy romance chat to Hugging Face Spaces