feat(security): implement AES-256-GCM encryption for API keys and HMAC-signed session tokens

This commit introduces:
- AES-256-GCM encryption for LLM provider API keys in the database.
- HMAC-SHA256 signed session tokens with activity-based refresh logic.
- Standardized frontend XSS protection using a global escapeHtml utility.
- Hardened security headers and request body size limits.
- Improved database integrity with foreign key enforcement and atomic transactions.
- Integration tests for the full encrypted key storage and proxy usage lifecycle.

src/database/mod.rs

@@ -18,7 +18,9 @@ pub async fn init(config: &DatabaseConfig) -> Result<DbPool> {
     let database_path = config.path.to_string_lossy().to_string();
     info!("Connecting to database at {}", database_path);
 
-    let options = SqliteConnectOptions::from_str(&format!("sqlite:{}", database_path))?.create_if_missing(true);
+    let options = SqliteConnectOptions::from_str(&format!("sqlite:{}", database_path))?
+        .create_if_missing(true)
+        .pragma("foreign_keys", "ON");
 
     let pool = SqlitePool::connect_with(options).await?;
 
@@ -29,7 +31,7 @@ pub async fn init(config: &DatabaseConfig) -> Result<DbPool> {
     Ok(pool)
 }
 
-async fn run_migrations(pool: &DbPool) -> Result<()> {
+pub async fn run_migrations(pool: &DbPool) -> Result<()> {
     // Create clients table if it doesn't exist
     sqlx::query(
         r#"
@@ -88,6 +90,8 @@ async fn run_migrations(pool: &DbPool) -> Result<()> {
             api_key TEXT,
             credit_balance REAL DEFAULT 0.0,
             low_credit_threshold REAL DEFAULT 5.0,
+            billing_mode TEXT,
+            api_key_encrypted BOOLEAN DEFAULT FALSE,
             updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
         )
         "#,
@@ -167,6 +171,15 @@ async fn run_migrations(pool: &DbPool) -> Result<()> {
         .execute(pool)
         .await;
 
+    // Add billing_mode column if it doesn't exist (migration for existing DBs)
+    let _ = sqlx::query("ALTER TABLE provider_configs ADD COLUMN billing_mode TEXT")
+        .execute(pool)
+        .await;
+    // Add api_key_encrypted column if it doesn't exist (migration for existing DBs)
+    let _ = sqlx::query("ALTER TABLE provider_configs ADD COLUMN api_key_encrypted BOOLEAN DEFAULT FALSE")
+        .execute(pool)
+        .await;
+
     // Insert default admin user if none exists (default password: admin)
     let user_count: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM users").fetch_one(pool).await?;
 
@@ -216,6 +229,19 @@ async fn run_migrations(pool: &DbPool) -> Result<()> {
         .execute(pool)
         .await?;
 
+    // Composite indexes for performance
+    sqlx::query("CREATE INDEX IF NOT EXISTS idx_llm_requests_client_timestamp ON llm_requests(client_id, timestamp)")
+        .execute(pool)
+        .await?;
+
+    sqlx::query("CREATE INDEX IF NOT EXISTS idx_llm_requests_provider_timestamp ON llm_requests(provider, timestamp)")
+        .execute(pool)
+        .await?;
+
+    sqlx::query("CREATE INDEX IF NOT EXISTS idx_model_configs_provider_id ON model_configs(provider_id)")
+        .execute(pool)
+        .await?;
+
     // Insert default client if none exists
     sqlx::query(
         r#"