security: stop the Space being an open, credentialed relay to the app API

diag: route-entered marker

diag: surface socket errors

diag: dump raw frames

diag: temp live-frames route (frame timings only, no key exposure)

CORS on the proxy so the Vercel frontend can call the space directly

Clean diagnostics: keep status/version/proxy only

childenv: include value lengths

Add child-env diagnostic

Add envcheck diagnostic (key names only)

Proxy: type the Request param for FastAPI DI

Proxy: forward method/query/body/headers, stream SSE both ways

Add Node runtime capability probe (userspace, no root)