CI/deploy hardening: lease push, concurrency, permissions, backup failure step, export snapshot, slimmer image (A11-01, A11-04..A11-07)

Comment cleanup: short Russian why-comments, no AI boilerplate

Security wave 2: gate deploy on push+own repo, 401 and denial logging on admin endpoints, FastAPI schema off, proxy body cap, ownerless pick confined to chat, loud warning about secrets derived from BOT_TOKEN

Luna audit fixes: album lock, multilingual routing, streaming budget, quota and persistence hardening

Groq provider: qwen head + gpt-oss reserve on light routes (calibrated 21.09.2026), streaming, quota/stats/diag, 8 tests

Comment polish: Russian pro-style comments, keep dated evidence short (+426/-2765). Fix: bot.send_chat_action -> bot.bot.send_chat_action (was AttributeError, typing indicator never showed)

P2: extract lumen_admin.py (FastAPI app, secret gates, admin/diag/export endpoints) with bot.X re-exports (AUD-A-001)