security: harden HTTP transport

[Macawls]

Summary

• Credentials moved from URL query params to X-Umami-* headers (query params still work as deprecated fallback)
• Configurable CORS origin restriction via ALLOWED_ORIGINS env var
• 1MB request body size limit to prevent OOM
• Session limit via MAX_SESSIONS env var (default 1000) with atomic counter
• websiteID validation to prevent path injection

New Environment Variables

Variable	Default	Description
ALLOWED_ORIGINS	*	Comma-separated CORS allowed origins
MAX_SESSIONS	1000	Maximum concurrent HTTP sessions

Test plan

• All existing tests updated and passing
• Header-based auth test
• Query param fallback test (deprecated path)
• Missing credentials returns -32602
• Body >1MB returns 413
• CORS origin restriction test
• Session limit test
• Session limit recovery after delete
• websiteID validation (UUID, path traversal, special chars)

Closes #19

🤖 Generated with Claude Code