Harden hosted alpha release controls

[vins13pattar]

Summary

• license the project under Apache-2.0 and update release/privacy documentation
• add PostgreSQL-backed guest/registered usage budgets and bounded retention
• add pseudonymous registration, recovery rotation, sign-in/out, and complete account deletion
• require bounded JSON mutation bodies and disable local stateless routes on durable deployments
• add an authenticated daily Vercel retention cron
• patch the transitive nanoid advisory and share the PostgreSQL pool with LangGraph checkpoints

Validation

• pnpm check in a clean worktree
• pnpm test:e2e — 7 Chromium journeys passed against configured Neon
• database integration suite — 8/8 passed against configured Neon
• pnpm audit:dependencies — no known vulnerabilities
• migration 0003_release_controls applied idempotently to hosted Neon

Release boundary

The custom domain is attached to the Vercel project but its Cloudflare DNS record is still missing. Real OpenAI BYOK/voice device validation and independent security, privacy, WCAG, and calibration reviews remain external release gates and are documented without being self-certified.