Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5

Fix Dockerfile: use flat app/ structure, remove backend/ paths

refactor: HF routing like RAG 1.2 — /ui, /widget, /admin, port 7860

fix: complete HF startup — libmagic, single worker, lazy models

fix: run Redis from app-owned config on HF

feat: use HF Space /data bucket for SQLite, Redis, and ChromaDB

fix: make app importable during Alembic migrations on HF

Add root Dockerfile and HF metadata to README

Update configurations and prepare for HF deployment

fix: add libmagic1 system dependency to Dockerfile to fix python-magic ImportError

fix: create /data/redis directory at runtime to handle HF persistent volume mount shadowing

fix: move redis config to /app/redis.conf (permission fix)

refactor: self-contained deployment - SQLite + local Redis (no external DBs needed)

Move Dockerfile to root for Hugging Face Spaces