[ancsingabor]

Adds an optional hosted Hungarian/English Aquinas Q&A page with local evidence retrieval, source quotations and role validation, separate generation/verification, and conservative abstention. A dedicated PostgreSQL ledger handles cost reservations, quotas, deduplication and dispatch fencing while keeping terminal/Python paths isolated.

Q&A remains disabled by default. This draft checkpoints implementation for review; it is not release acceptance or authorization to activate/deploy.

Validation

• All seven enabled local SpecGuard checks passed: corpus extraction, deterministic Q&A contracts, real disposable PostgreSQL integration, fixture Q&A Chromium, existing server regressions (112 tests), Python compatibility, and usage Chromium.
• The initial verification exposed migration syntax and two test-fixture issues; those were corrected and the separately authorized follow-up passed all enabled checks.
• Paid live evaluation was disabled/skipped, so the runner aggregate was skipped rather than all-passed. No live provider calls were made.
• Application files in this commit match the verified source. Subsequent publication edits are documentation/status updates only.

Remaining acceptance work

• Complete the acceptance cases missing from the current accounting/expiry/crash/quota, hostile-input and browser recovery/limit suites.
• Prepare and separately authorize live bilingual/source-quality evaluation with a competent reviewer and bounded adapter/costs.
• Establish corpus serving rights and operational evidence for canonical origin/proxy, authoritative durable ledger and restore fencing, provider bounds/retention, and receipt/backups.
• Record actual maintainer acceptance after required evidence is available. Follow-up tasks are tracked in the feature tasks document.

Public-repository hygiene

Only feature source, synthetic fixtures and public design/status documents are included. Private evidence/configuration, fixture credentials, real corpus bundles, internal organization identifiers and unrelated SpecGuard workflow changes are excluded. Secret scanning of the outgoing content found one inspected false positive in a SQL argument list and no credential findings. Raw evidence remains private.