fix(server): harden auth, SSE, state, scraping

- Fix SSE streams not terminating on successful jobs (C-2)
- Anchor data/session paths to BASE_DIR instead of CWD (C-3)
- Guard TelegramAuthManager state with RLock (H-1)
- Replace millisecond job ids with uuid4 (H-2)
- Always redact api_id/api_hash on export, drop include_secrets (H-3)
- Enforce JSON content-type + same-origin on mutating requests (H-4)
- Rate-limit auth attempts and phone-code requests (H-5)
- Deep-copy StateStore.load() on all paths (H-6)
- Cap FloodWait retries in forward_message (H-7)
- De-duplicate forwarding handler registration (H-8)
- Validate continuous channels at ingest, join scrape thread on account
  removal, fix refresh_config status under lock, cap SSE streams and
  JSON body size (M-5, M-6, M-17)
- Add regression tests (33 passing) and REVIEW.md

app_state.py

@@ -50,12 +50,12 @@ class StateStore:
         with self.lock:
             now = time.time()
             if self._cache is not None and (now - self._cache_time) < self._cache_ttl:
-                return dict(self._cache)
+                return deepcopy(self._cache)
             if not self.path.exists():
                 result = deepcopy(self.defaults)
                 self._cache = result
                 self._cache_time = now
-                return result
+                return deepcopy(result)
             try:
                 with self.path.open("r", encoding="utf-8") as handle:
                     state: Dict[str, Any] = json.load(handle)
@@ -63,11 +63,11 @@ class StateStore:
                 result = deepcopy(self.defaults)
                 self._cache = result
                 self._cache_time = now
-                return result
+                return deepcopy(result)
             result = self._merge_defaults(state)
             self._cache = result
             self._cache_time = now
-            return result
+            return deepcopy(result)
 
     def save(self, state: Dict[str, Any]) -> None:
         with self.lock: