Gateway request decoding, failure sanitization, and cleanup

Sanitize upstream, malformed-input, and provisional-identity failures to canonical { type: "server_error", message: "Gateway request failed" } payloads, preserving only upstream status and bounded allowlisted retry metadata. Never relay, log, persist, or expose upstream bodies, status text, URLs, credentials, request content, provider diagnostics, malformed successful text, or arbitrary parser/fetch errors; routing logs may record only an auth scheme. Read diagnostics privately only under a bounded timeout, then cancel or release readers. Before identity proof and durable commit, resolution content is never client-visible or stored; retain only fixed allowlisted internal log detail. Add regressions for response sanitization, retry-header clamping, stalled-body cancellation, and log redaction.