Wire HF_TOKEN secret into settings and propagate to environment

Code quality: fix all ruff warnings, add CI/CD, improve test coverage

Repo audit: fix security issues, bugs, and prepare HF Space deployment

Sprint 0: project foundation — structure, settings, FastAPI skeleton