Live user counter

Heartbeat-based live active user counter. Client pings /api/live every 30s, server counts recent heartbeats in DynamoDB with TTL. No WebSockets needed. Shipped in commit 0993e31.