Guest review links, signed uploads, SDK, and security polish

• Huddle guest links - share /huddle/review/{token} for client pin feedback without full login.
• Signed uploads - browsers can PUT straight to Storage via /api/uploads/signed (multipart still works).
• @hollahoop/sdk - tiny JS client for listPosts / createPost under packages/js.
• Preview deploy notes - GitHub preview URLs land as internal comments on linked posts.
• MCP/a11y - abuse trip logging, Redis storm cooldown, focus-visible + reduced-motion, broader axe paths.

Apply migration 0100_huddle_guest_links (and any earlier 0097-0099 not yet applied) on production.