v2.1.4: Security hardening, bug fixes, code quality improvements

- Move XOR keys to env vars (PRU_PROXY_KEY, PIPE_OBF_KEY)
- Fix multi-search to combine query + filters
- Fix deepTranslate to return clone instead of mutating
- Improve getBestStream quality matching and fallback
- Add input sanitization for all route params
- CORS blocks unknown origins in production
- Security headers in vercel.json at CDN level
- stats/genre uses Promise.allSettled for parallel execution
- Delete dead server.py, fix version strings

.env.example

@@ -1,5 +1,13 @@
-# Origins you want to allow
-ALLOWED_ORIGINS=https://site1.com,https://site2.com
+# Origins you want to allow (comma-separated, use * for all)
+ALLOWED_ORIGINS=https://miruro.tv,https://miruro.to,https://miruro.bz
 
 # Port (optional, defaults to 3000)
 PORT=3000
+
+# Pipe XOR obfuscation key (hex string, 32 chars)
+# Required for pipe response decoding
+PIPE_OBF_KEY=71951034f8fbcf53d89db52ceb3dc22c
+
+# PRU proxy XOR key (hex string, 32 chars)
+# Required for pru.ultracloud.cc URL encoding/decoding
+PRU_PROXY_KEY=a54d389c18527d9fd3e7f0643e27edbe