CORS proxy server with SSRF protection, host allow/blocklisting, and optional API key authentication.