Improve project readiness and delivery evidence

[LQ458]

Summary

• add a loopback-only MongoDB/Redis demo environment with idempotent anonymous fixtures
• make lint, production dependency audits, secret scanning, tests, and the production build explicit CI gates
• document the current architecture, media delivery behavior, dependency posture, and reproducible performance evidence
• clean existing frontend diagnostics and encode responsive media candidates with legacy URL compatibility
• refresh the README, screenshots, changelog, and contribution checks around verified project evidence

Verification

• npm run verify: backend tests, frontend tests, strict lint, and production build pass
• npm run audit:production: root and client production dependency audits report zero known advisories
• anonymous local browse, search, and detail flows verified with the demo fixture
• responsive image selection verified at fixed mobile and desktop viewports

Risk and boundaries

• no production database, media, Nginx, or service configuration changes
• no deployment or release is included
• the remaining client advisories are confined to the Create React App development/build chain and are documented
• Multer 1.x deprecation and the lack of an independent staging/recovery rehearsal remain documented follow-up items