fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction

- resolveBaseUrl() rejects client-supplied non-public baseUrls via assertPublicUrl (SSRF guard on /v1/search)
- fresh-install remote login with default password returns 403 without issuing a JWT
- /api/usage/request-details redacts request/providerRequest/providerResponse/response payloads
- declare chalk and prop-types in package.json (used but previously undeclared)

package.json

@@ -25,6 +25,7 @@
     "@next/third-parties": "^16.2.9",
     "@xyflow/react": "^12.10.1",
     "bcryptjs": "^3.0.3",
+    "chalk": "^5.6.2",
     "confbox": "^0.2.4",
     "express": "^5.2.1",
     "http-proxy-middleware": "^3.0.5",
@@ -37,6 +38,7 @@
     "node-machine-id": "^1.1.12",
     "open": "^11.0.0",
     "ora": "^9.1.0",
+    "prop-types": "^15.8.1",
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "react-is": "^16.13.1",