Resolve local audit issues 001-010

[epicycloids]

Summary

This branch resolves the local audit issues 001-010 and updates the public docs to match the resulting behavior.

Highlights:

• Fix checkpoint restore trial ID monotonicity and tell-result mismatch handling.
• Harden REST write endpoints with bearer-token auth and safe checkpoint paths.
• Remove unsafe dashboard HTML rendering and add XSS-oriented coverage.
• Preserve leaderboard behavior across objective topology changes.
• Unify save/load checkpoint semantics for CLI, REST/dashboard, Rust, and Python paths.
• Validate dynamic study configuration before runtime.
• Remove the orphaned REST API surface from opt_engine; REST now lives in hola.
• Track AutoStrategy issued suggestions so pending asks count against exploration budget.
• Reduce leaderboard ranking lock pressure.
• Minimize Tokio dependency features.
• Refresh REST, checkpoint, and strategy docs.

Validation

• Local dashboard smoke test with Playwright Chromium:
  • started hola serve with --dashboard dashboard
  • connected to the live dashboard
  • drove an active ask/tell optimization loop while the page was open
  • observed live SSE trial updates
  • verified final trial count/table/charts
  • saved a full checkpoint from the dashboard
• The smoke test reached 35 completed trials and saved /tmp/robopt-dashboard-smoke-checkpoints/checkpoint.json before cleanup.

Notes

• issues/ is now ignored; tracked local issue docs for 08-10 are included because they were created before the ignore rule and document the resolved audit items.
• opt_engine no longer exposes REST server code.