9 bite-sized tasks: gunicorn dep, create_app() factory + tests, HAL dict-return contract fix + bot_cli simplification, Dockerfile CMD swaps, dev override (Flask dev server preserved), api-server host port drop in base, AGENTS.md cleanup, aapanel-hardening.md (lifted from spec appendix), integration verification deferred. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>