add GET /model (serve 126MB streaming model for browser on-device; CF Pages 25MiB limit) + 5/h/IP limit

upgrade: /stream WebSocket (Muno459 streaming on-proxy) + per-IP rate limiting (stt 120/m, analyze 40/m, ws 3 concurrent) + model assets

add /stt proxy route

secure CORS proxy for muaalem endpoint

initial commit