Four upgrades to production

This workshop is closer to production than a notebook, but four honest gaps remain: single-process state, opaque session tokens, no audit trail, and a rate limiter that still ships as the in-memory single-budget version. The Redis-backed and per-route limiters you saw are exactly that upgrade path. Here is the full plan, in the order I would do it.

Postgres first because it unblocks everything else. Once users, sessions, and audit rows live in a real database, JWT becomes optional (you no longer need a session store) and audit logging becomes trivial (one insert per query). Doing the upgrades in any other order forces rework.