feat: add isolated zero-cost public demo

[Kuanyu458]

Summary

• add isolated Gradio pipeline for 1-5 public URLs
• enforce SSRF, redirect, size, timeout, quota, Turnstile replay, TTL, prompt-injection, and source-ID guards
• add structured Gemini text and two-speaker TTS providers with fail-closed free-tier behavior
• render one-page A4 PDF and 170-190 second MP3 in a Docker Space image

Verification

• 36 Python tests and Worker tests pass
• Docker image builds and starts
• /healthz and homepage return 200
• PDF is exactly one page; 390px layout has no overflow
• MP3 duration test: 180.048 seconds