fix: Phase 1 - security & stability patches

- AuthMiddleware now requires auth on /v1/* routes (returns 401)
- WebSocket origin check configurable via WSAllowedOrigin
- Removed debug fmt.Printf leaks (config, ollama, server)
- Registry access protected by sync.RWMutex (race condition fix)
- Session cleanup goroutine runs every 15 min
- RevokeSession returns error instead of silent no-op

internal/config/config.go

@@ -11,17 +11,18 @@ import (
 )
 
 type Config struct {
-	Server        ServerConfig        `mapstructure:"server"`
-	Database      DatabaseConfig      `mapstructure:"database"`
-	Providers     ProviderConfig      `mapstructure:"providers"`
-	EncryptionKey string              `mapstructure:"encryption_key"`
+	Server        ServerConfig   `mapstructure:"server"`
+	Database      DatabaseConfig `mapstructure:"database"`
+	Providers     ProviderConfig `mapstructure:"providers"`
+	EncryptionKey string         `mapstructure:"encryption_key"`
 	KeyBytes      []byte
 }
 
 type ServerConfig struct {
-	Port       int      `mapstructure:"port"`
-	Host       string   `mapstructure:"host"`
-	AuthTokens []string `mapstructure:"auth_tokens"`
+	Port            int      `mapstructure:"port"`
+	Host            string   `mapstructure:"host"`
+	AuthTokens      []string `mapstructure:"auth_tokens"`
+	WSAllowedOrigin string   `mapstructure:"ws_allowed_origin"`
 }
 
 type DatabaseConfig struct {
@@ -151,17 +152,14 @@ func Load() (*Config, error) {
 		return nil, fmt.Errorf("failed to unmarshal config: %w", err)
 	}
 
-	fmt.Printf("Debug Config: port from viper=%d, host from viper=%s\n", cfg.Server.Port, cfg.Server.Host)
-	fmt.Printf("Debug Env: LLM_PROXY__SERVER__PORT=%s, LLM_PROXY__SERVER__HOST=%s\n", os.Getenv("LLM_PROXY__SERVER__PORT"), os.Getenv("LLM_PROXY__SERVER__HOST"))
-
 	// Manual overrides for nested keys which Viper doesn't always bind correctly with AutomaticEnv + SetEnvPrefix
 	if port := os.Getenv("LLM_PROXY__SERVER__PORT"); port != "" {
 		fmt.Sscanf(port, "%d", &cfg.Server.Port)
-		fmt.Printf("Overriding port to %d from env\n", cfg.Server.Port)
+
 	}
 	if host := os.Getenv("LLM_PROXY__SERVER__HOST"); host != "" {
 		cfg.Server.Host = host
-		fmt.Printf("Overriding host to %s from env\n", cfg.Server.Host)
+
 	}
 
 	// Ollama overrides
@@ -175,8 +173,6 @@ func Load() (*Config, error) {
 		cfg.Providers.Ollama.Models = strings.Split(models, ",")
 	}
 
-	fmt.Printf("[DEBUG] Final Ollama Config: Enabled=%v, BaseURL=%s, Models=%v\n", cfg.Providers.Ollama.Enabled, cfg.Providers.Ollama.BaseURL, cfg.Providers.Ollama.Models)
-
 	// Validate encryption key
 	if cfg.EncryptionKey == "" {
 		return nil, fmt.Errorf("encryption key is required (LLM_PROXY__ENCRYPTION_KEY)")