Critical fixes + AWS-verified: multi-tenant pool, BYOK backups, GPT-5 client, web deploy (supersedes #37)