Move orchestration out of the route handlers into a service layer

Housekeeping: lint in CI, client lifecycle, and a truer breaker signal

Pin the MCP tool surface and give every tool an output schema

Stop reporting upstream failures as "patent not found"

Bound the list inputs and the outbound fan-out they cause

Test the API-key middleware, and stop it 500ing on a non-ASCII key

Add a circuit breaker to the multi-backend search fallback (item from review)

Run the container as a non-root user (item from review: Dockerfile hardening)

Validate patent_id shape before hitting Google Patents/OPS

Deduplicate app.py's search endpoints (item 4 from review)

Mirror SERPent from Hugging Face Space with bug fixes