security: harden gateway proxy, custom runtime proxy, and media routes (#95)

* security hardening pass 1 - otel removed

* hardening pass #2

* feat security hardening pass

* chore: trim unrelated docs from security hardening pr

* fix: address security hardening review findings

* address findings

tests/unit/studioSettingsRoute.test.ts

@@ -69,7 +69,7 @@ describe("studio settings route", () => {
     process.env.OPENCLAW_STATE_DIR = tempDir;
 
     const response = await PUT({
-      json: async () => "nope",
+      text: async () => JSON.stringify("nope"),
     } as unknown as Request);
     const body = (await response.json()) as { error?: string };
 
@@ -92,7 +92,7 @@ describe("studio settings route", () => {
     };
 
     const putResponse = await PUT({
-      json: async () => patch,
+      text: async () => JSON.stringify(patch),
     } as unknown as Request);
     expect(putResponse.status).toBe(200);