Security re-check and load test 2026-10-04: 32 threads, data file permissions, patched deps

- gunicorn gthread 8 -> 32 threads per worker: each assistant stream holds a thread for
  the whole answer; with 3x8, about 20 concurrent asks already queued ordinary page loads
  for seconds (up to 23 s at 50 asks locally, 7 s at 20 asks on the live server). With 3x32,
  75 concurrent asks kept page loads under 110 ms (laptop, simulated model and Qdrant)
- deploy.sh: new step closes the project dir to other accounts and sets the database and
  backups to 0600/0700 on every release; user `nobody` on the shared server could read
  db.sqlite3 and every backup
- requirements: python-dotenv 1.2.2, urllib3>=2.8.0 (known CVEs in the installed versions),
  gunicorn pinned to the server's version (was only installed by hand)
- security-before-production.md: items 19-23 (file permissions, DEBUG=1 still in the systemd
  unit, dependencies, frontend headers, guest AI cap per shared IP) and the reproduced
  X-Forwarded-For spoof through the origin IP
- model-prices.md: 0.183 cents per answer from 50 answers in the live load test

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

requirements.txt

@@ -4,8 +4,14 @@ drf-spectacular==0.30.0
 django-cors-headers==4.9.0
 requests==2.33.1
 redis==5.2.1
-python-dotenv==1.0.1
+python-dotenv==1.2.2
 whitenoise==6.11.0
+# همان نسخه‌ای که سرور با آن اجرا می‌شود (یونیتِ systemd آن را از venv صدا می‌زند). تا
+# ۲۰۲۶-۱۰-۰۴ در این فایل نبود و فقط دستی روی سرور نصب شده بود.
+gunicorn==26.2.0
+# وابستگیِ غیرمستقیمِ requests و qdrant-client. ۲.۷.۰ سه آسیب‌پذیریِ شناخته‌شده داشت
+# (GHSA-8988-9cw3-xx77، GHSA-vxq7-64xx-v4gw، GHSA-gh4c-6fx4-qh6g؛ OSV، ۲۰۲۶-۱۰-۰۴).
+urllib3>=2.8.0
 
 # RAG / AI tutor (اپ rag). کلاینت‌ها lazy import می‌شن؛ نبودِ این‌ها فقط
 # مسیرِ RAG رو از کار می‌ندازه، نه بقیه‌ی پروژه رو.