fix: export FastAPI app in app.py for HF Spaces routing

chore: exclude docs/*.pdf from git (managed on HF Space directly)

feat: add secure admin panel, session store, localStorage tracking