P0 security: async backup, widget CORS, Redis auth.

fix: keep run_backup as lazy import (celery not in local dev env)

refactor: Phase 6A+6B — top-level imports and Pydantic schema upgrades

Refactor: complete 10/10 modularity — superadmin/routers/, core/startup/, pipeline/generation.py, slim main.py