Safety first: the server enforces joint limits, speed limits, an emergency stop and a dead-man hold - no client can move the arm outside them #11

Goal (owner, 2026-10-20): complete, secure, public control of the real arm from the public forge URL, with a moderated community. Simple and amazing to use; every knob the owner might want is an admin setting.

Milestone 1 (secure control). On the server, never the browser: per-joint position limits and max velocity/acceleration (from config, conservative defaults); every command clamped and rate-limited (e.g. 60 Hz max); an E-stop the driver and any admin can hit (big, always visible) that halts motion and holds torque until an admin clears it; dead-man: no command for 1 s → hold position, connection lost → slow move to a safe park pose; the gripper force limited. Works against the simulated arm and the real one. Tests: out-of-range and too-fast commands are clamped; E-stop stops and blocks until cleared; silence → hold; disconnect → park.