fix: close SSRF in stream proxies and fix dotenv load order

Security:
- Fixed unauthenticated SSRF in /api/stream/proxy and /api/stream/ts-proxy
  - proxy allowlist had escape hatch via pathname.endsWith('.m3u8') bypass
  - ts-proxy had no destination validation at all
  - Both could fetch internal services (127.0.0.1, 169.254.169.254)
- Added streamProxy.helper.js with domain allowlist, private IP blocking,
  and http(s)-only enforcement applied to both endpoints
- Removed dead megaplay-1.buzz; added vid-tube.site, norami.top,
  kryntal.top, akirax.buzz to allowlist
- Added SECURITY.md with vulnerability reporting policy

Bug fix:
- Fixed dotenv.config() loading after static imports -- helpers reading
  process.env at top level never received .env values. Changed to
  import 'dotenv/config' as first import

Config:
- Added STREAM_PROXY_DOMAINS env var for custom allowlist
- Added STREAM_PROXY_REFERER env var for custom CDN Referer

.env.example

@@ -25,3 +25,12 @@ MIRROR_CACHE_TTL=3600000
 
 # Environment (production/development)
 NODE_ENV=production
+
+# Domains the M3U8/TS stream proxies may fetch from (comma-separated).
+# Subdomains are covered automatically, so list the registrable domain only.
+# Leave unset to use the built-in defaults.
+# STREAM_PROXY_DOMAINS=megaplay.buzz,vidtube.site,vid-tube.site,vidplay.site,anipixcdn.co,norami.top,kryntal.top,akirax.buzz
+
+# Referer sent to stream CDNs. They reject the site origin and an empty
+# Referer; only the player origin passes. Change if the player domain moves.
+# STREAM_PROXY_REFERER=https://megaplay.buzz/