feat(security): implement AES-256-GCM encryption for API keys and HMAC-signed session tokens

This commit introduces:
- AES-256-GCM encryption for LLM provider API keys in the database.
- HMAC-SHA256 signed session tokens with activity-based refresh logic.
- Standardized frontend XSS protection using a global escapeHtml utility.
- Hardened security headers and request body size limits.
- Improved database integrity with foreign key enforcement and atomic transactions.
- Integration tests for the full encrypted key storage and proxy usage lifecycle.

.env.example

@@ -25,4 +25,7 @@ LLM_PROXY__SERVER__AUTH_TOKENS=your_bearer_token_here,another_token
 LLM_PROXY__SERVER__PORT=8080
 
 # Database path (optional)
-LLM_PROXY__DATABASE__PATH=./data/llm_proxy.db
+LLM_PROXY__DATABASE__PATH=./data/llm_proxy.db
+
+# Session secret for HMAC-signed tokens (hex or base64 encoded, 32 bytes)
+SESSION_SECRET=your_session_secret_here_32_bytes