fix(security): bound fan-out and method surface and scrub relayed text

- Add a process-wide gate on MCP tools/list backend connections. The
  per-request limit alone let N callers open N times as many.
- Reject CONNECT and TRACE on native passthrough and on MCP and A2A
  targets with 405.
- Scrub URL query strings and the target URL from a backend JSON-RPC
  error message before it reaches the caller.
- Replace the value of redis.address in GET /admin/api/config. The
  users file path stays visible by design.
- Escape line breaks in every log line so an upstream string cannot
  forge log entries.
- Add stripClientAnthropicBeta. When true, POST /v1/messages does not
  forward the client anthropic-beta header. The default stays false.

routes_messages.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"strconv"
+	"strings"
 )
 
 // messagesPath is the inbound Anthropic Messages API route this gateway
@@ -212,6 +213,9 @@ func (g *Gateway) callAnthropicMessagesPassthrough(ctx context.Context, w http.R
 	hdr := http.Header{}
 	hdr.Set("Content-Type", "application/json")
 	for _, name := range anthropicPassthroughForwardedHeaders {
+		if g.cfg.StripClientAnthropicBeta && strings.EqualFold(name, "anthropic-beta") {
+			continue
+		}
 		for _, v := range clientHeaders.Values(name) {
 			hdr.Add(name, v)
 		}