Harden live data, account isolation, and iOS interactions

[ur1el0]

Summary

• Replace bundled demo catalog responses with live provider content and official cover metadata, with cached offline reading.
• Scope authentication, publishing, shelf state, reading statistics, and annotations to the owning account.
• Remove retired demo records with a versioned SQLite migration and provide online backup and integrity-check tooling.
• Bound request and story payload sizes, sanitize validation errors, rate-limit authentication, and validate CORS origins.
• Return paginated story summaries without manuscript text; fetch full text from story detail and chapter endpoints.
• Wire reader, writing, profile, shelf, and settings actions; require a validated HTTPS API URL for iOS Release builds.

Verification

• Backend suite: 43 passed in Docker.
• Docker Compose configuration, Python compilation, Release URL guard cases, and Xcode scheme XML validated locally.
• macOS CI is configured to run the iOS XCTest target and Release build. Those jobs have not run in this Fedora workspace.

Deployment note

The repository has no persistent backend database. Existing SQLite deployments apply the versioned cleanup on backend startup; it deletes only the retired demo IDs and their dependent shelf and reading-session records.