Align Curio recommendation contract with frontend refinements

[MohammedAlkindi]

Motivation

• The frontend collected richer preference and refinement signals (recommendationMode, commitmentLevel, avoidTitles, card actions) that the backend ignored, producing a misleading UX and weak explainability.
• The product needs deterministic, inspectable refinements (likes/dislikes/saves) wired into the ranking loop so user feedback has immediate, traceable effect.
• Improve operational posture and repo hygiene by tightening CORS defaults and removing committed Python bytecode.

Description

• Extended request schema with recommendationMode, commitmentLevel, avoidTitles, likedTitles, and dislikedTitles on UserPreferences and added richer response fields scoreBreakdown, matchReasons, detailsUrl, and top-level meta with summary and appliedRefinements in RecommendationResponse (backend models).
• Reworked the deterministic scoring engine to return per-component components in a ScoreBreakdown, incorporating mode-aware rating bias, commitment-format shifts, avoid-term penalties, and session liked/disliked signals while preserving additive, inspectable ranking logic.
• Improved explanation generation to prefer positive scored reasons and include grounded item signals (tags, pacing, complexity) rather than generic text.
• Wired frontend refinement loop and card actions: API base is configurable via meta/global/localStorage, the reset button clears session memory, More like this / Less like this update likedTitles/dislikedTitles in sessionStorage and re-submit payloads, Save persists to localStorage, and UI now renders meta.summary and meta.appliedRefinements.
• Hardened CORS to use ALLOWED_ORIGINS environment list (with sensible local defaults), added .gitignore for bytecode, removed tracked __pycache__, and updated README and architecture docs to reflect the evolved contract and behavior.
• Minor frontend CSS and HTML tweaks to support the new affordances and make result/meta rendering coherent.

Testing

• Ran python -m compileall backend/app to validate Python modules compiled successfully.
• Ran node --check frontend/main.js to validate the frontend script syntax and it passed.
• Attempted a FastAPI TestClient smoke test but it failed in this environment because httpx is not installed, so end-to-end API runtime verification could not complete here.

---

Codex Task