Harden subscription revoke, embed lock, SSRF, and auth fail-closed.

Fix analytics accuracy, tenant isolation, and event-loop blocking.

Production hardening: JWT blacklist, TOTP, Pydantic schemas, Prometheus, SSRF fix, CSP, Redis auth, Celery backup — 35 items across P0-P5

Restructure project for HF Spaces deployment