Add PCB-Merging and harden the web server for public deployment

[Roy101]

PCB-Merging (Du et al., NeurIPS 2024):

• pcb_merge() with intra-balancing (self-competition) x inter-balancing (cross-task consensus) scoring, top-ratio drop, score-weighted combine
• --method pcb with --pcb-ratio/--pcb-lambda/--pcb-scope; server passthrough; frontend method + fields; preset; docs; unit tests

Security hardening (all opt-in / safe-by-default; no new runtime deps):

• Uploads are safetensors-only by default; pickle/code files refused (_scan_unsafe_files). Every torch.load uses weights_only=True. Closes an arbitrary-code-execution path on uploaded checkpoints.
• Archive extraction gains zip-bomb defenses (entry count, uncompressed total enforced during copy, per-entry ratio) on top of the existing Zip-Slip guard.
• Merge worker is sandboxed: stripped environment, job-private cwd/HOME/TMPDIR, rlimits (CPU/file size), hard wall-clock timeout with process-group kill, and no network via an unprivileged namespace (unshare -rn) when available.
• Opt-in auth (MERGESE_REQUIRE_AUTH): hashed API keys + short-lived anonymous tokens (Turnstile-gated), per-caller daily/active-job quotas, and per-job ownership. Offline admin CLI (server/manage_keys.py). Off by default, so a trusted single-tenant install is unchanged and writes no auth artifacts.

Also: point the web UI GitHub link at srlabUsask/MergeSE; add flask to the dev extra so the server tests run under CI; docs/SECURITY.md deployment runbook.