server: gallery/carousel, promo-validator, fuzz #11/#12 remediations, embed port, observability
Fix integration tests for CSRF rotation, hashed API keys, and schema changes
Restructure into monorepo