Security and infrastructure hardening

A security and infrastructure release. We rolled the platform onto a new database credential system, tightened access controls on internal operations, and hardened how the site is built and served. No user-facing changes.