feat: pipe XOR decode + CDN CORS proxy for streaming

- decodePipeResponse now XOR-decodes with obfuscation key before gzip
- Updated pipe version to 0.2.0 to match miruro.tv
- Added /api/proxy endpoint for CORS-safe M3U8/VTT streaming
- Proxied stream/subtitle URLs through /api/proxy for browser playback
- M3U8 content rewritten to proxy variant playlists and segments

vercel.json

@@ -4,9 +4,17 @@
     {
       "src": "api/index.js",
       "use": "@vercel/node"
+    },
+    {
+      "src": "api/proxy.js",
+      "use": "@vercel/node"
     }
   ],
   "routes": [
+    {
+      "src": "/api/proxy",
+      "dest": "/api/proxy.js"
+    },
     {
       "src": "/api/(.*)",
       "dest": "/api/index.js"