PixelProof v1.4.0: Hostile-agent audit fixes, portfolio wiring, and cross-pick identity

A hostile-agent security audit and a same-day "Cumshot Audit" closed out P0/P1/CVE-worthy findings: sanitized error responses, type-guarded POST bodies, closed CSRF and enum gaps, a fixed welcome route, and a repaired paid-signup-count query that had referenced a non-existent column. Checkout errors now return a proper 503 JSON error instead of a bare 500, and every API route shares one error-handler implementation.

The bigger structural change this day was cross-pick: a shared `empire.customers` identity table, a `/products` portfolio page tying PixelProof, EntryProof, and TariffWatch together, and a portfolio footer strip on all three landing pages. Full-funnel PostHog conversion events now fire across all three picks, and custom 404/500 pages, iOS input-zoom fixes, and a deferred-Sentry perf pass rounded out the day.