- Add DEPLOYMENT_HANDOFF.md for client IT team with full production steps
- Fix ApiKeyMiddleware: correct Response import and fail-closed on unset key
- Remove committed Bridge API secret from all tracked docs
- Document seed, admin provisioning, WP user sync, Kavenegar, and wp-config hardening
- Reformat AGENT.md, README.md, CLIENT_DELIVERY.md to consistent structure