fix(security): harden API endpoints and resolve PR #674 review findings

- Fix X-Forwarded-For header spoofing in requireSensitiveLocalAccess (use socket-level address only)
- Add model ID length validation (max 256 chars) in PUT /models/:provider
- Add provider name validation (alphanumeric, max 64 chars) to prevent path traversal
- Add stale entry eviction for unbounded quotaRateLimits Map (>1000 entries)
- Fix concurrent refresh race in usage aggregator (wait for in-flight before forced refresh)
- Sanitize internal URLs/paths from OAuth failure diagnostics
- Add ValidationError class for denylist violations (distinct from system errors)
- Make CLIProxy sync interval configurable via CCS_CLIPROXY_SYNC_INTERVAL env var
- Improve legacy continuity config error logging (unconditional warn)
- Add CACHE_VERSION history comments

src/auth/profile-continuity-inheritance.ts

@@ -52,13 +52,11 @@ function loadLegacyContinuityInheritanceMap(): Record<string, string> {
 
     return normalized;
   } catch (error) {
-    if (process.env.CCS_DEBUG) {
-      console.error(
-        warn(
-          `Failed to parse legacy continuity mapping at "${configJsonPath}": ${(error as Error).message}`
-        )
-      );
-    }
+    console.error(
+      warn(
+        `Failed to parse legacy continuity mapping at "${configJsonPath}": ${(error as Error).message}`
+      )
+    );
     return {};
   }
 }