security: fix key exposure, timing-safe admin auth, remove admin bypass, cap params, harden usage recording

- Fix 1 (keys.mjs): listKeys() no longer leaks full API key field in response
- Fix 2 (server.mjs): Remove BIND_ADDRESS admin bypass from isAdmin check
- Fix 3 (server.mjs): Admin key comparison now uses timingSafeEqual
- Fix 4 (server.mjs): Cap limit (max 500) and hours (max 720) in GET /api/usage
- Fix 5 (server.mjs): Streaming error path now computes promptChars from messages
- Fix 6 (server.mjs): Warn at startup if AUTH_MODE=shared but PROXY_API_KEY is empty
- Fix 7 (server.mjs): All recordUsage calls wrapped in try/catch to prevent DB errors crashing server
- Fix 8 (server.mjs): CORS fallback changed from "*" to specific origin (http://127.0.0.1:<PORT>)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

keys.mjs

@@ -63,9 +63,9 @@ export function listKeys() {
   const d = getDb();
   return d.prepare(
     "SELECT id, key, name, created_at, revoked FROM api_keys ORDER BY created_at DESC"
-  ).all().map(k => ({
-    ...k,
-    keyPreview: k.key.slice(0, 8) + "..." + k.key.slice(-4),
+  ).all().map(({ key, ...rest }) => ({
+    ...rest,
+    keyPreview: key.slice(0, 8) + "..." + key.slice(-4),
   }));
 }