Fix analytics accuracy, tenant isolation, and event-loop blocking.

fix: 5 critical storage bugs + 3 SQLite/SSE bugs -- tracker.py: db.flush() after add() so chat messages/analytics are persisted -- chat.py: flush->commit for durable ChatSession row -- settings.py: fix session mismatch in all PUT routes (widget-config, profile, personality, notifications, password) - setattr on cross-session user was discarded; now uses UPDATE stmt on route db -- aggregator.py: replace PostgreSQL-only gen_random_uuid() with uuid4() param for SQLite -- ingest.py: fix SSE channel name mismatch subscriber vs publisher -- superadmin_service.py: fix naive/aware datetime TypeError in extend_subscription

Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5

Fix token display for unsubscribed authors and add SuperAdmin author removal.

Unify token tracking, smart links, and personality settings across admin and chat.

Fix revoke subscription hang caused by blocking SMTP email send.

fix: naive vs aware datetime error in grants/extend/embed-token, grant button loading state + 15s timeout + token display modal

feat: Per-user auto embed token, full Token Management SA page, fix extend on expired subs, add /grants + /reset-tokens + /embed-token endpoints

Fix grant_access return: was returning raw SQLAlchemy model, now returns JSON-serializable dict matching AccessGrantResponse schema

Deep audit fix: add missing model columns (blocked, rating, tokens_used, out_of_scope_message, buy_url, preview_url), fix .get() calls, fix ingest doc creation, add track-click endpoint, add column migrations, fix email crash, fix audit log field names, enrich superadmin author list

Restructure project for HF Spaces deployment