Fix 429 rate limits and show friendly errors in widget.

feat: Phases 1-5 production improvements + 8 bug fixes

Convert ALL middleware to pure ASGI: eliminate BaseHTTPMiddleware completely to fix request body consumption bug causing 500 on ALL endpoints

Phase 4+5: Fix rate limiter paths (/api/v1 -> /api/chat|auth|admin), add SecurityHeadersMiddleware (HSTS, XSS, CSRF, CSP), fix QA export auth, fix route ordering

Restructure project for HF Spaces deployment