fix: CORS proxy missing timeout, size limits, and encoded path traversal check

[rohilsurana]

Problem

The API proxy (src/server/api/apis-proxy.ts) has three hardening gaps:

1. Encoded path traversal — only checks path.includes('..') which misses encoded variants like %2e%2e
2. No fetch timeout — upstream requests can hang indefinitely, tying up server resources
3. No request body size limit — arbitrarily large payloads accepted, potential DoS vector

These matter because the proxy accepts user input from the "Try it out" API playground in the browser.

Suggested Fix

• Use path.resolve() with a prefix whitelist check instead of string matching
• Add AbortSignal.timeout(30_000) to the upstream fetch() call
• Validate Content-Length header and reject bodies over a reasonable limit (e.g. 1MB)

[rohilsurana]

Addressed in #150:

• Fetch timeout: Added 2-minute AbortSignal.timeout on upstream fetch to prevent hanging workers
• Body size limit: Added 50MB Content-Length check before JSON parsing to prevent OOM
• Encoded path traversal: decodeURIComponent before the .. check so %2e%2e and similar encoded variants are caught

For query injection — we're a transparent proxy, the upstream server is responsible for validating its own query parameters.