feat(ssr): spider-only SSR — serve CSR shell for regular users

Add spider detection gate to SSR server so that search engine
crawlers get full server-side rendering with fresh API data,
while regular users receive the static CSR app shell from disk.

- backend/app/spider_detection.py: Python spider detection module
- spider_detection.ts: TypeScript mirror of spider detection patterns
- server.ts: SSR gate — isSpider() check before dispatching to
  Angular SSR engine; non-spiders get static index.html
- server.spec.ts: Added spider detection unit tests
- tsconfig.app.json: Include spider_detection.ts in compilation
- backend/app/models.py: Fix SQLAlchemy FK resolution (user_models import)

server.ts

@@ -4,7 +4,10 @@ import {
   isMainModule,
   writeResponseToNodeResponse,
 } from '@angular/ssr/node';
+import * as fs from 'node:fs';
 import * as http from 'node:http';
+import * as path from 'node:path';
+import { isSpider, getUserAgent } from './spider_detection';
 
 /**
  * Manually import and register the Angular app engine manifest.
@@ -20,6 +23,36 @@ import { ɵsetAngularAppEngineManifest } from '@angular/ssr';
 
 const appEngine = new AngularNodeAppEngine();
 
+/**
+ * Resolve the static browser index.html path.
+ * In the built output the browser files live in the `browser/` subdirectory.
+ */
+function browserIndexPath(): string {
+  // __dirname in ESM resolves to this file's directory
+  const dir = typeof __dirname !== 'undefined' ? __dirname : path.dirname(new URL(import.meta.url).pathname);
+  return path.join(dir, 'browser', 'index.html');
+}
+
+/**
+ * Serve the static CSR app shell from disk.
+ *
+ * Regular browser users get the prerendered HTML shell — Angular hydrates
+ * client-side and fetches fresh config via the API. This avoids the SSR
+ * overhead for every human request while still delivering a fast first paint.
+ */
+function serveStaticShell(res: http.ServerResponse): void {
+  const indexPath = browserIndexPath();
+  try {
+    const content = fs.readFileSync(indexPath, 'utf-8');
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.setHeader('X-Render-Mode', 'CSR');
+    res.end(content);
+  } catch {
+    res.statusCode = 500;
+    res.end('Internal server error — index.html not found');
+  }
+}
+
 const requestHandler = createNodeRequestHandler(async (req, res, next) => {
   try {
     const response = await appEngine.handle(req);
@@ -39,6 +72,17 @@ if (isMainModule(import.meta.url)) {
   const server = http.createServer();
   server.on('request', async (req, res) => {
     try {
+      // ── Spider detection gate ──────────────────────────
+      // Only search engine spiders get full SSR rendering.
+      // Regular users receive the static CSR app shell from disk,
+      // which hydrates client-side and fetches fresh data from the API.
+      const userAgent = getUserAgent(req.headers);
+      if (!isSpider(userAgent)) {
+        serveStaticShell(res);
+        return;
+      }
+
+      // Spider — render full HTML via Angular SSR with live API data
       await requestHandler(req, res, () => {
         res.statusCode = 404;
         res.end('Not Found');