fix(api,validation): standardize CrawlScheduleController envelope and enforce validateParams on all route identifiers

fix(security,architecture): harden Helmet CSP, CORS callback, cascade webhook deactivation, and AuthService dependency injection

feat(backend): upgrade data crawler backend with schedule crawl, change detection, and Supabase support