Widget identity, Huddle form embed, journey timeline, and API hardening

This batch lands several product surfaces that were stuck in progress:

• Widget JWT identity — host apps can pass a signed token so embed submissions attribute to a known user.
• Huddle — register sites, detect platform, and drop a light feedback form via /huddle.js (pin mode still follows).
• CI pills on admin feedback cards when a run URL is present.
• Customer journey timeline under Settings → Accounts.
• Axe CI on / and /login.
• MCP/REST shared IP+key rate limits, 429 storm cooldown, and secret redaction in errors.

Apply migration 0096_huddle_foundation on each environment before using Huddle admin.