Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5

Enforce strict SuperAdmin vs Author panel separation.

Fix auth session expiry with shared auto-refresh client for admin panels.

CRITICAL: Fix </script> inside template literal breaking ALL JS after embed code generator, fix invalid dummy bcrypt hash causing login 500 errors

Deep audit fix: add missing model columns (blocked, rating, tokens_used, out_of_scope_message, buy_url, preview_url), fix .get() calls, fix ingest doc creation, add track-click endpoint, add column migrations, fix email crash, fix audit log field names, enrich superadmin author list

Fix: accept any email/username at login, add is_superadmin to response, fix [object Object] error display

Restructure project for HF Spaces deployment