feat: implement 15 production items (SSE, security, observability, features, infra)

Performance:
- SSE dashboard streaming endpoint (GET /v1/admin/status/stream)
- Web Worker for markdown rendering (offload from main thread)
- IndexedDB chat persistence (replace localStorage, 500msg support)

Security:
- CSRF protection middleware (Origin/Referer validation)
- Content Security Policy + security headers middleware
- API key rotation endpoint (POST /v1/admin/keys/rotate)

Observability:
- OpenTelemetry tracing with graceful NoOp fallback
- Structured error codes (FAGI-xxxx taxonomy with ErrorResponse schema)
- Audit log export (CSV + JSON at /v1/admin/audit/export/*)

Features:
- Multi-session management hook (parallel conversations)
- Conversation export (markdown/JSON/text download + clipboard)
- Head customization UI (enable/disable + weight sliders for 12 heads)

Infrastructure:
- Kubernetes Helm chart (Deployment, Service, HPA, Ingress)
- Database migration versioning (generate, verify commands)
- Blue-green deployment manifests (color-based traffic switching)

Tests: 598 Python + 56 frontend = 654 total, 0 ruff errors
Co-Authored-By: Nakamoto, S <defi@defi-oracle.io>

tests/test_migration_runner.py

@@ -0,0 +1,34 @@
+"""Tests for the migration runner."""
+
+from migrations.migrate import get_applied, get_connection, migrate_down, migrate_up, verify
+
+
+def test_migrate_up_and_status(tmp_path):
+    """Should apply all migrations and track them."""
+    db_path = str(tmp_path / "test.db")
+    count = migrate_up(db_path)
+    assert count >= 2  # At least the 2 existing migrations
+
+    conn = get_connection(db_path)
+    applied = get_applied(conn)
+    assert "001_initial_schema" in applied
+    assert "002_add_sessions_and_audit" in applied
+
+
+def test_migrate_down(tmp_path):
+    """Should rollback the last migration."""
+    db_path = str(tmp_path / "test.db")
+    migrate_up(db_path)
+    result = migrate_down(db_path)
+    assert result is True
+
+    conn = get_connection(db_path)
+    applied = get_applied(conn)
+    assert "002_add_sessions_and_audit" not in applied
+    assert "001_initial_schema" in applied
+
+
+def test_verify():
+    """Verify should apply migrations to a temp DB cleanly."""
+    result = verify()
+    assert result is True