feat(security): implement AES-256-GCM encryption for API keys and HMAC-signed session tokens

This commit introduces:
- AES-256-GCM encryption for LLM provider API keys in the database.
- HMAC-SHA256 signed session tokens with activity-based refresh logic.
- Standardized frontend XSS protection using a global escapeHtml utility.
- Hardened security headers and request body size limits.
- Improved database integrity with foreign key enforcement and atomic transactions.
- Integration tests for the full encrypted key storage and proxy usage lifecycle.

migrations/002-add-indexes.sql

@@ -0,0 +1,13 @@
+-- Migration: add composite indexes for query performance
+-- Adds three composite indexes:
+-- 1. idx_llm_requests_client_timestamp on llm_requests(client_id, timestamp)
+-- 2. idx_llm_requests_provider_timestamp on llm_requests(provider, timestamp)
+-- 3. idx_model_configs_provider_id on model_configs(provider_id)
+
+BEGIN TRANSACTION;
+
+CREATE INDEX IF NOT EXISTS idx_llm_requests_client_timestamp ON llm_requests(client_id, timestamp);
+CREATE INDEX IF NOT EXISTS idx_llm_requests_provider_timestamp ON llm_requests(provider, timestamp);
+CREATE INDEX IF NOT EXISTS idx_model_configs_provider_id ON model_configs(provider_id);
+
+COMMIT;