feat: add guarded Xquik server and remove tracked secrets

[kriptoburak]

Summary

• Add a local FastAPI proxy for the current Xquik OpenAPI contract.
• Expose reads by default and gate every non-GET operation.
• Keep the Xquik key server-side and refuse upstream redirects.
• Remove 2 tracked .webui_secret_key files and ignore future copies.

Independent Fix

The base repository tracked secret-key files under servers/flashcards and servers/time-ui. This change removes both files without reading or reproducing their contents. Any deployed copies should be treated as compromised and rotated.

Safety

• The proxy uses a fixed Xquik HTTPS origin.
• Incoming cookies, authorization, and API-key headers are never forwarded.
• The normalized 2026-04-29 response contract is always requested.
• Non-GET operations require server opt-in and per-call approval.
• Redirects, oversized bodies, oversized responses, and invalid schemas fail closed.
• Returned X content carries an untrusted-content response header.

Validation

• Python 3.11 regression suite: 17 passed.
• Ruff check and format validation.
• Strict mypy validation.
• Bandit reports no findings.
• Application dependency audit reports no known vulnerabilities.
• Live Xquik schema: 73 read operations and 56 guarded non-GET operations.
• Live schema normalization prevents duplicate /api/v1 prefixes.
• git diff --check.

No live X data or account action was requested.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[kriptoburak]

Rebuilt this PR on current main as signed commit 992a39b. The independent fix removes 2 tracked .webui_secret_key files without reading their contents and adds a repository-wide ignore rule. Please rotate any deployed copies. The Xquik server now mirrors the live OpenAPI contract, exposes 73 reads by default, and guards all 56 non-GET operations behind server opt-in plus per-call approval. All 17 regressions and the security, type, formatting, dependency, and live-schema checks pass.