Fix: CSP connect-src for jsdelivr + better create author error display

Fix: CSP expanded to allow Google Fonts and jsdelivr CDN used by admin SPA

Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5

Fix auth session expiry with shared auto-refresh client for admin panels.

Fix SecurityHeadersMiddleware: rewrite as pure ASGI to avoid BaseHTTPMiddleware request body consumption bug

Phase 4+5: Fix rate limiter paths (/api/v1 -> /api/chat|auth|admin), add SecurityHeadersMiddleware (HSTS, XSS, CSRF, CSP), fix QA export auth, fix route ordering