Harden sharing and deployment security

[PengfanZ]

What changed

• Harden anonymous Supabase RPC rejection handling and secret-peppered rate limiting.
• Bound shared-URL decompression and block framed rendering.
• Remove the third-party analytics fallback and tighten the production CSP.
• Pin GitHub Actions and vulnerable transitive dependencies.
• Expand pgTAP, unit, integration, and Playwright security coverage.
• Update security, privacy, architecture, analytics, and deployment documentation.

Why

This closes the reviewed security gaps without changing Tally's existing activity workflows or its 90-day backend retention policy.

Validation

• 280 unit/integration tests with 100% statement, branch, function, and line coverage.
• 118 pgTAP backend assertions.
• 12 Playwright E2E scenarios.
• ESLint, TypeScript, production PWA build, and git diff --check.
• Production dependency audit: 0 vulnerabilities.
• Browser smoke test with no relevant console errors.