feat: add backend proxy layer to keep auth tokens server-side

[mrgoonie]

Overview

Adds an optional backend proxy server that allows keeping GoClaw authentication tokens server-side, improving security for production deployments.

Changes

New Proxy Server (server/)

• proxy-server.ts: HTTP + WebSocket server with origin validation, per-IP connection limits, and graceful shutdown
• websocket-proxy-session.ts: Handles individual client connections, intercepts connect frames to inject auth tokens server-side
• connection-tracker.ts: Per-IP rate limiting to prevent abuse
• proxy-config.ts: Environment variable configuration with sensible defaults
• package.json: Node.js server with ws as sole production dependency
• .env.example: Configuration template for deployment

Widget Updates

• Updated src/types.ts to support new proxyUrl configuration option
• Modified src/websocket-client.ts to connect via proxy when configured
• Token is now optional when using proxy mode

Documentation & Examples

• Updated CLAUDE.md, README.md, code-standards.md with proxy server details
• Updated system-architecture.md with dual-mode security model
• Added examples/proxy-mode.html demonstrating secure deployment pattern
• Updated project-overview-pdr.md with proxy architecture

Security Benefits

• Token never exposed to client: Proxy holds credentials server-side
• Origin validation: Restrict connections by domain
• Rate limiting: Per-IP connection limits prevent abuse
• Reverse proxy support: TRUST_PROXY flag for nginx/Cloudflare deployments

Deployment

cd server && npm install
cp .env.example .env  # Configure GOCLAW_URL and GOCLAW_TOKEN
npm run dev           # Development
npm run build && npm start  # Production

Architecture

Browser Widget → Proxy Server (:3100) → GoClaw Gateway (:9090)
  (no token)      (holds token)          (validates token)