Security:
- Production startup guard (refuse shadow mode in ENVIRONMENT=production)
- Client-side 8s fetch timeout (AbortController)
- Spam-click protection (useRef inflight guard)
- Input sanitization (control char stripping)
- Rate-limit UI feedback with Retry-After header

Added:
- DemoErrorBoundary component
- Retry-After header on 429 responses (backend + proxy)

527 tests passing.