security: address GateTest findings — heredoc injection + ci hardening

security: address GateTest findings — heredoc injection + ci hardening

Critical fix: the AI root-cause analysis step in hetzner-deploy.yml was
using an unquoted heredoc to build a JSON request body that embedded
${{ github.event.head_commit.message }}. Because the heredoc was not
quoted, bash expanded $(...) and `...` inside it — a commit message
containing a backtick command substitution could have executed arbitrary
commands on the runner with access to ANTHROPIC_API_KEY and the SSH key.
Swapped to a python3 heredoc with json.dumps over os.environ so every
untrusted input is properly JSON-encoded and never reaches bash.

CI hardening: added top-level `permissions: read-all` to fly-deploy,
hetzner-deploy, and stripe-bootstrap. The GITHUB_TOKEN was defaulting
to the broad write scope it inherits at the repo level; none of these
workflows need write access via the token (deploys use SSH/Fly API/
Stripe API keys, not the GITHUB_TOKEN).

Repo metadata: added `license`, `repository`, and `engines.node` to
package.json so the npm registry and supply-chain scanners can resolve
the project metadata.

Other GateTest findings reviewed and not actioned because they were
intentional with code comments explaining why:
  - httpOnly:false on csrf double-submit cookie (JS must read it)
  - httpOnly:false on theme cookie (pre-paint script must read it)
  - new Function(onRunDone) in sse-client (dev-supplied JS, not user input)
  - eval() / new Function() matches in intelligence.ts (regex patterns
    for detecting eval in user code, not actually calling eval)

https://claude.ai/code/session_01QFLWDxWw65DX6enMcS5Lwe