fix: close SSRF in stream proxies and fix dotenv load order

Security:
- Fixed unauthenticated SSRF in /api/stream/proxy and /api/stream/ts-proxy
  - proxy allowlist had escape hatch via pathname.endsWith('.m3u8') bypass
  - ts-proxy had no destination validation at all
  - Both could fetch internal services (127.0.0.1, 169.254.169.254)
- Added streamProxy.helper.js with domain allowlist, private IP blocking,
  and http(s)-only enforcement applied to both endpoints
- Removed dead megaplay-1.buzz; added vid-tube.site, norami.top,
  kryntal.top, akirax.buzz to allowlist
- Added SECURITY.md with vulnerability reporting policy

Bug fix:
- Fixed dotenv.config() loading after static imports -- helpers reading
  process.env at top level never received .env values. Changed to
  import 'dotenv/config' as first import

Config:
- Added STREAM_PROXY_DOMAINS env var for custom allowlist
- Added STREAM_PROXY_REFERER env var for custom CDN Referer

server.js

@@ -16,7 +16,13 @@
  * ======= • ======= • ======= • ======= • =======• =======
  */
 
-import dotenv from "dotenv";
+// WARNING: This import must stay first. Static imports are evaluated before the
+// module body runs, so a dotenv.config() call down there fires only after every
+// helper has already been evaluated — and helpers that read process.env at their
+// top level (mirror, cache, proxy, streamProxy) would silently keep their
+// defaults. Importing dotenv/config runs config() as an import side effect, so
+// .env is populated before any of those modules load.
+import "dotenv/config";
 import express from "express";
 import compression from "compression";
 import path from "path";
@@ -27,8 +33,6 @@ import { dirname } from "path";
 import { createApiRoutes } from "./src/routes/apiRoutes.js";
 import { addCreatorInfo } from "./src/middleware/creatorInfo.js";
 
-dotenv.config();
-
 // ══════════════════════════════════════════════════════════════
 // SERVER CONFIGURATION
 // ══════════════════════════════════════════════════════════════