server: gallery/carousel, promo-validator, fuzz #11/#12 remediations, embed port, observability
Phase 2 integration tests: rate limiting + promo code checkout