Publish buildable Free Core source

[ResearchForumOnline]

What changed

• publish the first buildable FreeWebPanel Core API source under core/api
• initialize production state with one owner and no demo customer or billing fixtures
• add scrypt password hashing, hashed bearer sessions, login throttling, atomic mode-0600 state, account creation, strict domain validation, and constrained site-root provisioning
• document the exact public/private source boundary
• run Core lint, tests, and build in GitHub Actions

Why

The public repository previously described Free Core but contained only the installer wrapper and documentation. This release makes a useful, security-scoped control-plane slice auditable without exposing Pro automation, payment settlement, vendor signing keys, customer data, private themes, or production inventory.

Validation

• npm run lint
• npm test (3/3)
• npm run build
• npm audit --omit=dev (0 vulnerabilities)
• repository Markdown relative-link check
• repository secret-pattern scan