Run #15: fix 5 SERIOUS findings; seal subscription access gate
server: gallery/carousel, promo-validator, fuzz #11/#12 remediations, embed port, observability
v0.5.19: split large modules; remove dead find_or_create_tag