Loops API keys server-side only

Trap: putting a Loops API key in an embeddable signup form looks convenient because the form can call the provider directly, but keys are exposed to every visitor and Loops does not support browser CORS requests. Fix: send signup and contact-management requests through a server-side service using Authorization: Bearer ...; keep keys privately managed, purpose-separated, and revocable. Treat double-opt-in confirmation as the point at which contact.created becomes authoritative.