fix: close pre-launch validation and deployment gaps

[adamXbot]

The pre-launch review found gaps in download validation, edge webhook restrictions, container health checks, and automated coverage. This change closes those gaps across the server, CLI, and edge worker.

• Run all component unit suites and edge packaging in CI; regenerate the CLI version before tests and isolate terminal locale settings.
• Validate UUIDs on bulk/device downloads, normalize device UUIDs, and preserve first-download format attribution.
• Block forwarding when an explicitly configured edge allowlist contains no usable rules.
• Use one public-path normalizer for generated URLs, routing, and host restrictions; cover custom paths over real HTTP.
• Use the configured dashboard hostname for Docker health probes and smoke-test each native CLI binary before packaging.
• Record repository checks and remaining deployment sign-off in docs/PRE-LAUNCH-CHECKLIST.md.

Validation on the combined branch: all package type checks and 507 unit tests pass (297 server, 146 CLI, 64 edge). CI also runs Postgres integration tests, production HTTP tests, Next/CLI builds, edge packaging, and dependency audit. The initial review additionally verified actual Docker image startup/health and a native macOS arm64 CLI binary.

Production HTTPS, backups/restore, real alert delivery, optional Wallet, and a deployed edge worker still require deployment-specific sign-off.