feat: implement 15 production items (SSE, security, observability, features, infra)

Performance:
- SSE dashboard streaming endpoint (GET /v1/admin/status/stream)
- Web Worker for markdown rendering (offload from main thread)
- IndexedDB chat persistence (replace localStorage, 500msg support)

Security:
- CSRF protection middleware (Origin/Referer validation)
- Content Security Policy + security headers middleware
- API key rotation endpoint (POST /v1/admin/keys/rotate)

Observability:
- OpenTelemetry tracing with graceful NoOp fallback
- Structured error codes (FAGI-xxxx taxonomy with ErrorResponse schema)
- Audit log export (CSV + JSON at /v1/admin/audit/export/*)

Features:
- Multi-session management hook (parallel conversations)
- Conversation export (markdown/JSON/text download + clipboard)
- Head customization UI (enable/disable + weight sliders for 12 heads)

Infrastructure:
- Kubernetes Helm chart (Deployment, Service, HPA, Ingress)
- Database migration versioning (generate, verify commands)
- Blue-green deployment manifests (color-based traffic switching)

Tests: 598 Python + 56 frontend = 654 total, 0 ruff errors
Co-Authored-By: Nakamoto, S <defi@defi-oracle.io>

k8s/values.yaml

@@ -0,0 +1,119 @@
+# FusionAGI Helm Chart values
+
+replicaCount: 2
+
+image:
+  repository: fusionagi/api
+  pullPolicy: IfNotPresent
+  tag: "latest"
+
+frontend:
+  enabled: true
+  replicaCount: 2
+  image:
+    repository: fusionagi/frontend
+    tag: "latest"
+
+service:
+  type: ClusterIP
+  port: 8000
+
+frontendService:
+  type: ClusterIP
+  port: 80
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
+    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
+  hosts:
+    - host: fusionagi.local
+      paths:
+        - path: /v1
+          pathType: Prefix
+          backend: api
+        - path: /
+          pathType: Prefix
+          backend: frontend
+
+resources:
+  api:
+    limits:
+      cpu: "2"
+      memory: 2Gi
+    requests:
+      cpu: 500m
+      memory: 512Mi
+  frontend:
+    limits:
+      cpu: 500m
+      memory: 256Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 10
+  targetCPUUtilizationPercentage: 70
+  targetMemoryUtilizationPercentage: 80
+
+postgresql:
+  enabled: true
+  auth:
+    database: fusionagi
+    username: fusionagi
+    existingSecret: fusionagi-db-secret
+  primary:
+    persistence:
+      size: 10Gi
+
+redis:
+  enabled: true
+  architecture: standalone
+  auth:
+    enabled: false
+  master:
+    persistence:
+      size: 2Gi
+
+env:
+  FUSIONAGI_DB_BACKEND: postgres
+  FUSIONAGI_WORKERS: "4"
+  FUSIONAGI_RATE_LIMIT: "120"
+  FUSIONAGI_LOG_LEVEL: info
+
+secrets:
+  apiKey:
+    existingSecret: fusionagi-api-secret
+    key: api-key
+  postgresDsn:
+    existingSecret: fusionagi-db-secret
+    key: dsn
+  redisUrl:
+    existingSecret: fusionagi-redis-secret
+    key: url
+
+bluegreen:
+  enabled: false
+  active: blue
+  blueTag: "latest"
+  greenTag: "latest"
+
+healthCheck:
+  livenessProbe:
+    httpGet:
+      path: /health
+      port: 8000
+    initialDelaySeconds: 10
+    periodSeconds: 15
+  readinessProbe:
+    httpGet:
+      path: /ready
+      port: 8000
+    initialDelaySeconds: 5
+    periodSeconds: 10