fix: harden proxy security, account selection, and scheduler lifecycle

[MagicalTux]

Full-codebase review (fanned out across subsystems; every finding verified against the code before fixing). Grouped by area.

🔒 Security — MITM/CONNECT path

• Unauthenticated CONNECT → account-token theft / open relay (HIGH). The proxy-apiKey gate lived only on the HTTP handler. A remote client could CONNECT api.anthropic.com:443 and get one of your account tokens injected (curl -k --proxy victim:3456 …), or blind-tunnel to any host (open relay / SSRF to cloud metadata). Fix: gate the CONNECT handler with the same key check the HTTP path uses (loopback-exempt, else Proxy-Authorization).
• Bind 127.0.0.1 by default (opt into a wider bind with TEAMCLAUDE_HOST / config.proxy.host) — defense-in-depth so the port isn't reachable off-box unless you ask for it.
• Constant-time proxy-key comparison on both gates; chmod 0600 config/state on every save (mode is ignored when the file already exists).

🐞 Correctness

• _selectNext fallback resurrected disabled/errored accounts — the "all unavailable → soonest reset" path force-cleared their state and routed a live request to an operator-disabled or dead-token account. Now skips hard-state accounts.
• Model-ownership bypass — the probe and soonest-reset fallbacks ignored models ownership, so an owned model could be routed to a non-owner (which just rejects it). Both paths now honor ownership. _accountOwnsModel returns a real boolean; the match predicate is shared; addAccount sets throttledAt.
• server: a non-transient error after headers hangs the client → now destroyed; a pinned request whose account is unavailable did a pointless fleet-wide wait → short-circuits; backpressure wait leaked a close listener per drain cycle on long SSE → mutual cleanup; the idle-timeout read could surface as an unhandledRejection → swallowed.
• upstream-fetch: per-call sx Agent used keepAlive:true, leaking a tunneled socket per request with no reuse benefit → keepAlive:false.
• mitm: a transient cert error poisoned the memoized promise and killed the MITM path until restart → reset on failure; tunnel sockets leaked on one-sided errors → both torn down on error/close (+ connect/idle timeout).

♻️ Lifecycle

• No SIGTERM handler in TUI mode — a systemd/kill bypassed cleanup, losing up to ~1 min of unsaved quota state and orphaning schedulers. Now both modes register SIGINT/SIGTERM with a forced-exit backstop.
• warmer: stop() now aborts an in-flight sweep and kills the claude child (no orphan, no shutdown hang); a signal-killed child is an error, not a success; an interval change no longer triggers an extra quota-spending sweep (only off→on does). Same off→on fix in prober.
• status-renderer surfaces the keep-warm summary (was --json-only).

Tests

connect-auth.test.js (the CONNECT gate + safeKeyEqual), selection-hardening.test.js (resurrection + ownership-fallback guards), warmer stop/abort + no-extra-sweep. 194 tests pass, lint clean. Boot smoke-tested: binds 127.0.0.1, status carries warm, pin 404s.

Not fixed (noted, low/edge or deferred)

• Unbounded request-body buffering (DoS) — much lower risk now that the default bind is loopback; skipped to avoid capping legitimately large requests.
• AccountUuidPatcher 36-byte overwrite assumes a 36-char value (real Claude Code always sends one) — left the delicate state machine untouched.
• warmer.js↔prober.js share a scheduler skeleton — worth extracting a base class, but deferred (didn't want a structural refactor mixed into these fixes).
• prober fires all accounts concurrently; _withTimeout doesn't abort the fetch — low, opt-in path.

🤖 Generated with Claude Code