chore: merge upstream Wei-Shaw/sub2api latest (v0.1.130+)
Upstream features: bedrock CC compat, email whitelist wildcard,
content moderation per-model toggle, redeem code batch update,
OIDC verified-email fast path, subscription expiry email,
cache hit rate fix, audit dedup, js-cookie security fix,
x/net vulnerability fix, OpenAI account cooldown optimization,
reverse proxy client IP fix, API key ACL trusted forwarded IP.
Local additions preserved: rpmTokenBucketService, quotaFactor
scoring, P2C scheduler selection.
e938be5f3f