Security review remediation

[kcosr]

Summary

• harden URL canonicalization, config validation, capture/logging, external auth, certificate generation, and proxy resource handling
• document encoded path separator behavior and remaining upstream-normalization risk
• add regression coverage for forged external-auth callback request IDs

Validation

• cargo fmt
• cargo clippy
• cargo test
• cargo build --release