chore: clean up dead code and unused deps before v1.0

- Remove unused category_service and dead imports
- Restrict HsCodeSerializer to public fields only
- Explicitly open auth/permissions on search view
- Remove unused packages from requirements