Auth, mobile nav, and security foundation

Password reset and recovery links now route through /auth/confirm and /auth/callback on your production domain instead of localhost. Welcome and admin provision emails send a secure one-time link to view login credentials (not the password in the inbox). Dashboard gets a mobile bottom nav at 375px, security headers and CSRF/rate limits on auth endpoints, and the composer shows Instagram 24h publish quota with download-for-manual-post when API publish is blocked.