fix: harden agent recovery and tool-call parsing

[ForgetMeAI]

Summary

• make DeepSeek tool-call parsing accept the observed canonical/doubled/fullwidth DSML variants while rejecting partial, multiple, oversized, or trailing envelopes;
• preserve bounded agent context across empty responses, context overflow, expired sessions, account rotation, and continuations;
• return typed upstream/context/timeout errors instead of retry storms or consumed response bodies;
• bind to loopback by default, add optional constant-time proxy bearer auth, and enforce exact browser-origin CORS for normal and SSE responses;
• compact large tool schemas without changing literal const, enum, or default values;
• remove Chrome manifest references to icon files that do not exist.

Contributor work integrated

• the safe network/auth portion of feat: add delta-prompt optimization and enhance proxy security #12 is integrated with its author credited in the commit trailer;
• the missing-icon bug reported by fix: Add icons for Chrome Extension #9 is resolved without importing third-party artwork.

Verification

• npm test: 39/39 passing;
• git diff --check: clean;
• local HTTP smoke: public/private health, bearer auth, model listing, rejected remote Origin, accepted exact loopback Origin;
• independent adversarial review of retry/session/account-rotation and DSML completeness paths.

Live DeepSeek upstream E2E was not run because repository/user auth secrets were intentionally not accessed.

Refs #9, #10, #12, #19, #23.