v2.1.4: Security hardening, bug fixes, code quality improvements

- Move XOR keys to env vars (PRU_PROXY_KEY, PIPE_OBF_KEY)
- Fix multi-search to combine query + filters
- Fix deepTranslate to return clone instead of mutating
- Improve getBestStream quality matching and fallback
- Add input sanitization for all route params
- CORS blocks unknown origins in production
- Security headers in vercel.json at CDN level
- stats/genre uses Promise.allSettled for parallel execution
- Delete dead server.py, fix version strings

test.js

@@ -104,7 +104,7 @@ async function runTest(test) {
 }
 
 async function runAll() {
-  console.log(`\n🧪 MiruroAPI v2.1.0 — Running ${tests.length} tests...\n`);
+  console.log(`\n🧪 MiruroAPI v2.1.4 — Running ${tests.length} tests...\n`);
 
   for (const test of tests) {
     await runTest(test);