fix(security): pre-launch security hardening audit & remediation (#320)

- Webhook HMAC: capture raw request bytes via express.json verify callback
  instead of re-serializing with JSON.stringify
- AES-256-GCM: use NIST-recommended 12-byte IV (backward compatible with
  existing 16-byte IVs)
- Node proxy tokens: add 1-year default expiry (previously no expiry)
- Host console env filtering: pattern-based approach blocking SECRET,
  PASSWORD, TOKEN, KEY, CREDENTIAL keywords (previously only 4 explicit keys)
- CORS: deny cross-origin requests when FRONTEND_URL is unset in production
  (previously fell back to allowing all origins)

docs/features/webhooks.mdx

@@ -127,5 +127,6 @@ Each webhook tracks its last 100 executions. Click **Recent executions** on any
 - Webhook secrets are 64-character hex strings generated with `crypto.randomBytes(32)`
 - Signature validation uses `crypto.timingSafeEqual` to prevent timing attacks
 - Secrets are shown only once at creation - API responses return masked values
+- Signature verification uses the raw request bytes, not re-serialized JSON, to prevent serialization-induced mismatches
 - Webhook trigger endpoints are public (no session cookie required) but protected by HMAC signature validation
 - Each webhook targets a single stack - there is no way to execute arbitrary commands