Harden dev server, fix Pages build, complete runtime deps, remove dead files.

[ahmaddurrerehman-glitch]

Ran the stack locally per Prof. Zhou's request and audited current main, after the
codebase-quality-audit merge. Below are the issues that survived that audit, plus a few
that only surface on a clean provision. All fixes verified locally.

Deploy — production served unbuilt source
static.yml uploaded ./PanTS-Demo (the raw Vite tree) as the Pages artifact with no build
step, so the deployed page shipped index.html referencing /src/main.tsx and unbundled TS
modules the browser cannot execute. Added setup-node (npm cache keyed on package-lock),
npm ci, npm run build, and switched the artifact to ./PanTS-Demo/dist.

Security — backend dev server

• run_simple() bound to 0.0.0.0 with use_debugger=True. The Werkzeug interactive
  traceback console evaluates arbitrary Python, so exposing it on all interfaces is an
  unauthenticated RCE surface for anyone on the network. Host and debugger are now
  env-gated (FLASK_HOST / FLASK_DEBUG), defaulting to loopback with the debugger off.
• CORS(app) reflected any origin on every route. Restricted to an ALLOWED_ORIGINS
  allowlist scoped to /api/* (defaults to the dev origin).

Fresh-install correctness (surfaced by provisioning from scratch)

• requirements.txt omits five imported packages, scikit-image, trimesh, PyPDF2,
  SimpleITK, matplotlib, so a clean env raises ModuleNotFoundError at boot. Added.
• .env.development set VITE_API_BASE to :8000 with nothing listening; backend serves
  :5001. Corrected, so the proxy resolves out of the box.

Hygiene
Removed a 3.9 MB committed minified bundle (flask-server/index-Bv-pE24x.js) and four
grep-confirmed unreferenced files, one whose name contains U+2014 em-dashes and breaks
checkout on charset-strict filesystems. CornerstoneNifti2.tsx left intact (imported in
four modules).

Verification
npm run build green (tsc -b + Vite, dist/ emitted). Backend boots on the hardened config
and the frontend round-trips through the Vite proxy: /api/search -> 200 {"items":[],"total":0}.

Follow-ups (not in this PR)

• Re-enable cross-origin isolation (COOP: same-origin + COEP) to restore the
  SharedArrayBuffer viewer path; requires making cross-origin assets (Google Fonts)
  COEP-compatible or self-hosting them first.
• api/utils.py hard-fails at import when PANTS/metadata.xlsx is absent; graceful
  degradation would let the app boot without the dataset.