v2.1.4: Security hardening, bug fixes, code quality improvements

- Move XOR keys to env vars (PRU_PROXY_KEY, PIPE_OBF_KEY)
- Fix multi-search to combine query + filters
- Fix deepTranslate to return clone instead of mutating
- Improve getBestStream quality matching and fallback
- Add input sanitization for all route params
- CORS blocks unknown origins in production
- Security headers in vercel.json at CDN level
- stats/genre uses Promise.allSettled for parallel execution
- Delete dead server.py, fix version strings

api/proxy.js

@@ -1,6 +1,9 @@
 const axios = require("axios");
 
-const PROXY_KEY = Buffer.from("a54d389c18527d9fd3e7f0643e27edbe", "hex");
+const PROXY_KEY = Buffer.from(
+  process.env.PRU_PROXY_KEY || "a54d389c18527d9fd3e7f0643e27edbe",
+  "hex"
+);
 const PRU_BASE = "https://pru.ultracloud.cc/";
 
 function base64urlXor(str) {