feat(security): implement AES-256-GCM encryption for API keys and HMAC-signed session tokens

This commit introduces:
- AES-256-GCM encryption for LLM provider API keys in the database.
- HMAC-SHA256 signed session tokens with activity-based refresh logic.
- Standardized frontend XSS protection using a global escapeHtml utility.
- Hardened security headers and request body size limits.
- Improved database integrity with foreign key enforcement and atomic transactions.
- Integration tests for the full encrypted key storage and proxy usage lifecycle.

static/js/auth.js

@@ -50,6 +50,12 @@ class AuthManager {
         });
     }
 
+    setToken(newToken) {
+        if (!newToken) return;
+        this.token = newToken;
+        localStorage.setItem('dashboard_token', this.token);
+    }
+
     async login(username, password) {
         const errorElement = document.getElementById('login-error');
         const loginBtn = document.querySelector('.login-btn');