Run combined image as authenticated Python worker

[georgi]

Summary

• replace the co-located TypeScript main process with the standalone Python WebSocket worker
• keep WanGP MCP bound to loopback and require bearer authentication on the public worker
• remove all container-side database/master-key setup and document request-scoped secret delivery
• add an authenticated worker/MCP health check

Validation

• ruff check .
• ty check .
• pytest -q (116 passed)
• required source-boundary grep returns no matches
• entrypoint syntax and fail-closed startup gates checked