fix(v2.2.0): migrate to new Miruro pipe protocol — restore streaming endpoints

The streaming endpoints (/episodes, /sources, /stream, /watch, /download)
returned 500 because the upstream Miruro pipe changed and www.miruro.tv is
now hard-blocked by Cloudflare.

Reverse-engineered the current Miruro frontend contract:
- Request is plain base64url of the JSON payload (no XOR).
- Response obfuscation is now signalled by the x-obfuscated header:
  absent = plain JSON, 1 = base64+gzip, 2 = base64+XOR(PIPE_OBF_KEY)+gzip.

pipe.js now:
- rotates across mirrors (miruro.ru > .to > .bz > .tv), one per retry;
- decodes based on the x-obfuscated header instead of always XOR+gunzip;
- sends full browser sec-fetch/sec-ch-ua headers to pass Cloudflare checks;
- raises maxRetries to 4 and rotates on 403/444.

proxy.js default referer/Origin -> https://www.miruro.to (miruro.tv is dead).

AniList-backed endpoints were already healthy and are unaffected.
Version bumped to 2.2.0 across package.json, server.js, /api/health,
/api/openapi, public/openapi.json. CHANGELOG updated.

api/proxy.js

@@ -209,7 +209,7 @@ module.exports = async function handler(req, res) {
     const decoded = decodePruUrl(url);
     const isPru = !!decoded;
     const targetUrl = decoded ? decoded.url : url;
-    const targetReferer = decoded ? decoded.referer : referer || "https://www.miruro.tv/";
+    const targetReferer = decoded ? decoded.referer : referer || "https://www.miruro.to/";
 
     let fetchUrl;
     let fetchHeaders;
@@ -219,8 +219,8 @@ module.exports = async function handler(req, res) {
       fetchUrl = encodeForPru(targetUrl, targetReferer);
       fetchHeaders = {
         "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
-        Referer: "https://www.miruro.tv/",
-        Origin: "https://www.miruro.tv",
+        Referer: "https://www.miruro.to/",
+        Origin: "https://www.miruro.to",
       };
     } else {
       fetchUrl = targetUrl;