feat(security): harden request boundaries and API coverage

[typelicious]

What changed

• adds a small runtime security block with bounded JSON body, upload, and routing-header limits
• adds conservative response headers and a restrictive CSP for the no-build dashboard
• hardens request parsing for chat, route preview, image generation, and image editing paths
• adds functional API tests for dashboard headers, payload limits, upload limits, and sanitized routing-header behavior
• updates README, architecture, onboarding, integrations, troubleshooting, releases, roadmap, and security docs to match the runtime behavior

Why

This is the main pre-v1.0 hardening slice for v0.9.x. It closes obvious request-boundary and operator-surface gaps while expanding functional coverage around real API entrypoints.

How verified

• PYTHONPYCACHEPREFIX="$PWD/.pycache" python3 -m compileall foundrygate tests
• PYTHONPATH=. ./.venv-check-313/bin/pytest -q
• ./.venv-check-313/bin/ruff check foundrygate tests
• ./.venv-check-313/bin/ruff format --check foundrygate tests
• ./.venv-check-313/bin/python -m build --no-isolation
• ./.venv-check-313/bin/python -m twine check dist/*
• PATH=/opt/homebrew/bin:$PATH /usr/bin/git diff --check