feat(security): implement AES-256-GCM encryption for API keys and HMAC-signed session tokens

This commit introduces:
- AES-256-GCM encryption for LLM provider API keys in the database.
- HMAC-SHA256 signed session tokens with activity-based refresh logic.
- Standardized frontend XSS protection using a global escapeHtml utility.
- Hardened security headers and request body size limits.
- Improved database integrity with foreign key enforcement and atomic transactions.
- Integration tests for the full encrypted key storage and proxy usage lifecycle.

src/dashboard/users.rs

@@ -14,9 +14,10 @@ pub(super) async fn handle_get_users(
     State(state): State<DashboardState>,
     headers: axum::http::HeaderMap,
 ) -> Json<ApiResponse<serde_json::Value>> {
-    if let Err(e) = auth::require_admin(&state, &headers).await {
-        return e;
-    }
+    let (session, _) = match auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
 
     let pool = &state.app_state.db_pool;
 
@@ -66,9 +67,10 @@ pub(super) async fn handle_create_user(
     headers: axum::http::HeaderMap,
     Json(payload): Json<CreateUserRequest>,
 ) -> Json<ApiResponse<serde_json::Value>> {
-    if let Err(e) = auth::require_admin(&state, &headers).await {
-        return e;
-    }
+    let (session, _) = match auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
 
     let pool = &state.app_state.db_pool;
 
@@ -147,9 +149,10 @@ pub(super) async fn handle_update_user(
     Path(id): Path<i64>,
     Json(payload): Json<UpdateUserRequest>,
 ) -> Json<ApiResponse<serde_json::Value>> {
-    if let Err(e) = auth::require_admin(&state, &headers).await {
-        return e;
-    }
+    let (session, _) = match auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
 
     let pool = &state.app_state.db_pool;
 
@@ -249,8 +252,8 @@ pub(super) async fn handle_delete_user(
     headers: axum::http::HeaderMap,
     Path(id): Path<i64>,
 ) -> Json<ApiResponse<serde_json::Value>> {
-    let session = match auth::require_admin(&state, &headers).await {
-        Ok(s) => s,
+    let (session, _) = match auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
         Err(e) => return e,
     };