fix(security): patch critical/high defects from code audit

[icebear0828]

Summary

• Auth bypass — move proxy_api_key validation before active === 0 early-return in chat route, closing a gate where unauthenticated requests could reach the proxy handler
• Timing side-channel — replace === with crypto.timingSafeEqual in validateProxyApiKey
• Bearer case-insensitivity — use /^bearer\s+/i regex per RFC 7235
• Compact infinite loop — cap retry attempts at 8 with 502 fallback
• Semaphore destroy race — add _destroyed flag to RefreshScheduler to prevent negative _running after destroy()

Also includes prior commit: log codex request reasoning in egress details.

Test plan

• npx tsc --noEmit — zero errors
• npm test — 230 files, 2274 tests pass
• Manual: send request with lowercase bearer prefix → should authenticate
• Manual: verify compact endpoint returns 502 after exhausting retries