sec: harden modal worker, update deployment docs, and add pre-push safety checks

NaturalCAD: add hosted backend flow and Space fixes