P0 security: async backup, widget CORS, Redis auth.

Reconcile .cursorrules against codebase — update 40+ rule statuses.

Implement Enterprise Worth Roadmap (R-139–R-173).

Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5