Add enterprise growth APIs, billing, admin UI, and test suite.

Fix 429 rate limits and show friendly errors in widget.

feat: Phases 1-5 production improvements + 8 bug fixes

Fix: CSP connect-src for jsdelivr + better create author error display

Fix: CSP expanded to allow Google Fonts and jsdelivr CDN used by admin SPA

Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5

Fix auth session expiry with shared auto-refresh client for admin panels.

Convert ALL middleware to pure ASGI: eliminate BaseHTTPMiddleware completely to fix request body consumption bug causing 500 on ALL endpoints

Fix SecurityHeadersMiddleware: rewrite as pure ASGI to avoid BaseHTTPMiddleware request body consumption bug

Phase 4+5: Fix rate limiter paths (/api/v1 -> /api/chat|auth|admin), add SecurityHeadersMiddleware (HSTS, XSS, CSRF, CSP), fix QA export auth, fix route ordering

Restructure project for HF Spaces deployment