Fix polynomial ReDoS in request-text parsing, tighten token file mode

[teamchong]

Nineteen code-scanning alerts. Four were real, fixed here. Fifteen were dismissed on the alert after measuring them.

Fixed

Three parsers walked untrusted request text with patterns that restart at every candidate position, so cost was quadratic in input length. Worst case is text that never satisfies the pattern, which is what a malformed or truncated body looks like.

Site	Input	Before	After
<env> body	400KB, no closing tag	5.0s	0.7ms
static-tag scan	'<A ' x80000	18.2s	0.1ms
minifyForRender	one 400KB line of spaces	76.3s	0.1ms

The <env> and static-tag bodies used a lazy [\s\S]*? span, which rescans the tail once per candidate opening. The static-tag scan had a second, independent quadratic: matching openings with (?:\s[^>]*)?> rescans the tail once per candidate tag when no > follows. Fixing only the span left the alert open, which is what CodeQL caught on the first revision of this PR. Both now scan by index. minifyForRender walks back from the end of the line.

run_shard.py wrote the OAuth token file under the default umask and chmod'd it to 0600 afterwards, leaving it briefly readable by other users on the host. It is opened 0600 now. Caching the token on disk is deliberate, the proxy re-reads it per request so a task can outlive its token.

Dismissed

Twelve of the remaining ReDoS reports are anchored on a required literal prefix, which bounds the ambiguity. Measured flat under 1ms from 5KB to 640KB on matching, non-matching, and repeated-prefix inputs. Two of them (applicability.ts:23, gpt-model-profiles.ts:525) gate model selection and are deliberately identical to each other, so rewriting them to satisfy the scanner risks a routing regression for no measured gain. The proxy.ts and messages-chat-bridge.ts patterns normalize config URLs read at startup, not request data.

node.ts:1293 logs the cloudflare upstream URL, built only as .../accounts/${cfAccount}/ai/v1. That is the account id, not a credential. CLOUDFLARE_API_TOKEN is passed separately and never interpolated.

Checks

vitest run        52 files, 945 tests
tsc --noEmit      clean

Behaviour is unchanged, not just green. The rewrites were differentially fuzzed against the original regexes (500k cases for the tag scan, 400k for minifyForRender, no mismatches), and the hand-written character classifiers were compared against /[a-zA-Z0-9_-]/ and /\s/ across all 65536 BMP codepoints. That last check caught a real bug: I had included U+0085, which JS /\s/ does not match.

tests/redos-guard.test.ts fails on the unfixed code, the tag-scan guard at 15.3s against a 5s budget, so it is a regression net rather than a restatement of the implementation.

The four fixed alerts stay open until CodeQL rescans after merge.