fix(server): harden auth, SSE, state, scraping

- Fix SSE streams not terminating on successful jobs (C-2)
- Anchor data/session paths to BASE_DIR instead of CWD (C-3)
- Guard TelegramAuthManager state with RLock (H-1)
- Replace millisecond job ids with uuid4 (H-2)
- Always redact api_id/api_hash on export, drop include_secrets (H-3)
- Enforce JSON content-type + same-origin on mutating requests (H-4)
- Rate-limit auth attempts and phone-code requests (H-5)
- Deep-copy StateStore.load() on all paths (H-6)
- Cap FloodWait retries in forward_message (H-7)
- De-duplicate forwarding handler registration (H-8)
- Validate continuous channels at ingest, join scrape thread on account
  removal, fix refresh_config status under lock, cap SSE streams and
  JSON body size (M-5, M-6, M-17)
- Add regression tests (33 passing) and REVIEW.md

scraper_jobs.py

@@ -1,11 +1,14 @@
 import asyncio
 import logging
+from pathlib import Path
 from typing import Any, Dict, List, Optional
 
 from app_state import StateStore
 
 logger = logging.getLogger(__name__)
 
+BASE_DIR = Path(__file__).resolve().parent
+
 
 class ScraperJobService:
     def __init__(self, state_store: StateStore):
@@ -28,7 +31,7 @@ class ScraperJobService:
         # Extract account_id from payload, default to None (legacy)
         account_id: Optional[str] = payload.get("account_id")
         ScraperClass = self._import_scraper_class()
-        scraper = ScraperClass(account_id=account_id)
+        scraper = ScraperClass(account_id=account_id, base_dir=BASE_DIR)
 
         if account_id:
             from app_state import load_account