Full ATOM backend sync from D:/Annator/ATOM/atom/backend + HF slim runtime (part 3)

CSP fix: explicit script-src unsafe-eval + allow HF iframe (backend/core/security/__init__.py)

Full stack ATOM backend + AIMONEYFLOW clients (port 7860) (part 4)