feat(security): implement AES-256-GCM encryption for API keys and HMAC-signed session tokens

This commit introduces:
- AES-256-GCM encryption for LLM provider API keys in the database.
- HMAC-SHA256 signed session tokens with activity-based refresh logic.
- Standardized frontend XSS protection using a global escapeHtml utility.
- Hardened security headers and request body size limits.
- Improved database integrity with foreign key enforcement and atomic transactions.
- Integration tests for the full encrypted key storage and proxy usage lifecycle.

src/config/mod.rs

@@ -1,5 +1,7 @@
 use anyhow::Result;
+use base64::{Engine as _};
 use config::{Config, File, FileFormat};
+use hex;
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -96,6 +98,7 @@ pub struct AppConfig {
     pub model_mapping: ModelMappingConfig,
     pub pricing: PricingConfig,
     pub config_path: Option<PathBuf>,
+    pub encryption_key: String,
 }
 
 impl AppConfig {
@@ -136,7 +139,8 @@ impl AppConfig {
             .set_default("providers.grok.enabled", true)?
             .set_default("providers.ollama.base_url", "http://localhost:11434/v1")?
             .set_default("providers.ollama.enabled", false)?
-            .set_default("providers.ollama.models", Vec::<String>::new())?;
+            .set_default("providers.ollama.models", Vec::<String>::new())?
+            .set_default("encryption_key", "")?;
 
         // Load from config file if exists
         // Priority: explicit path arg > LLM_PROXY__CONFIG_PATH env var > ./config.toml
@@ -167,6 +171,19 @@ impl AppConfig {
         let server: ServerConfig = config.get("server")?;
         let database: DatabaseConfig = config.get("database")?;
         let providers: ProviderConfig = config.get("providers")?;
+        let encryption_key: String = config.get("encryption_key")?;
+
+        // Validate encryption key length (must be 32 bytes after hex or base64 decoding)
+        if encryption_key.is_empty() {
+            anyhow::bail!("Encryption key is required (LLM_PROXY__ENCRYPTION_KEY environment variable)");
+        }
+        // Try hex decode first, then base64
+        let key_bytes = hex::decode(&encryption_key)
+            .or_else(|_| base64::engine::general_purpose::STANDARD.decode(&encryption_key))
+            .map_err(|e| anyhow::anyhow!("Encryption key must be hex or base64 encoded: {}", e))?;
+        if key_bytes.len() != 32 {
+            anyhow::bail!("Encryption key must be 32 bytes (256 bits), got {} bytes", key_bytes.len());
+        }
 
         // For now, use empty model mapping and pricing (will be populated later)
         let model_mapping = ModelMappingConfig { patterns: vec![] };
@@ -185,6 +202,7 @@ impl AppConfig {
             model_mapping,
             pricing,
             config_path: Some(config_path),
+            encryption_key,
         }))
     }