Refactor/audit fixes and dynamic rbac permissions

See merge request !9

docs(swagger): add complete openapi 3.0 path specs and component schemas for all remaining endpoints

fix(api,validation): standardize CrawlScheduleController envelope and enforce validateParams on all route identifiers

fix(security,architecture): harden Helmet CSP, CORS callback, cascade webhook deactivation, and AuthService dependency injection

feat(auth): support avatar file upload and enforce gmail registration

See merge request !8

feat(auth): implement dynamic RBAC and privilege escalation defense

See merge request !7

feat(auth): implement user self-deactivation with email verification

See merge request !6

fix: resolve P0/P1 audit findings for security, architecture, and race conditions

See merge request !5

refactor(common): standardize hardcoded constants and enforce zero-hardcode architecture

See merge request !4

feat(core): implement essential saas and crawler lifecycle features

See merge request !3

fix(core): remediate backend audit findings across P0-P3 vulnerabilities and performance issues

See merge request !2

fix(core): resolve P0/P1 audit findings across security, tenant isolation, and scheduler'

See merge request !1

feat(backend): upgrade data crawler backend with schedule crawl, change detection, and Supabase support