Harden public API budgets and AI privacy

[PengfanZ]

What changed

• Fail closed for future app-owned database function privileges.
• Add project-wide daily circuit breakers for anonymous live-activity creation and analytics.
• Preserve current public RPC contracts while lowering the per-client live-create limit.
• Require zero-data-retention routing for AI expense requests.
• Add clear English and Simplified Chinese AI privacy notices.
• Isolate feedback pgTAP fixtures and add public API security coverage.
• Update architecture, privacy, security, analytics, live-sharing, and AI documentation.

Why

The public frontend intentionally exposes a small capability-based RPC surface. This release limits project-wide abuse, prevents future privileged functions from becoming executable by default, and makes the optional AI data path explicit without changing existing live links or client contracts.

Validation

• 565 Vitest tests passed.
• 100% statements, branches, functions, and lines.
• 273 pgTAP database checks passed.
• 14 core Playwright journeys passed.
• 14 AI Playwright journeys passed.
• ESLint passed.
• TypeScript passed.
• GitHub Pages production build passed.

Screenshots

Not applicable; the only visible change is explanatory AI privacy copy.

Remaining risk

GitHub Pages cannot attach custom HTTP security headers. Existing meta CSP and clickjacking protection remain in place.