security: fix ENCRYPTION_KEY default, /verify-payment broken access control, path-traversal in design_name endpoints, /designs header-spoofing

feat: Supabase auth + Razorpay billing + fix API double-URL bug

feat: add Docker + HuggingFace Spaces deployment pipeline