fix: API keys now use env-only when IMA_API_KEYS is set; reject non-ASCII placeholder cookies

fix: 思考内容可见 + Anthropic 流式协议修复