Add SafetyKernel.reactivate(), wire all LLM providers in server
lifespan, add metrics_require_auth and rate_limit_strict config,
port soft-halt logic to AsyncStreamingKernel, document retrieval
strategy in PUBLIC_API.md.

Co-Authored-By: Arcane Sapience <protoscience@anulum.li>