prevent proxy cookie leakage

[MustafaMulla29]

Summary

• prevent cookies scoped to the proxy origin from being forwarded to the target
• continue forwarding cookies explicitly supplied through X-Sender-Cookie
• add passing regression coverage for both behaviors

Root cause

The proxy initializes its outbound headers by copying the incoming browser
request. A request to the local /proxy route can therefore contain cookies
scoped to localhost. When X-Sender-Cookie is empty, the copied Cookie
header was left untouched and forwarded to EasyEDA, whose CloudFront/WAF can
reject the unexpected cookie with 403 Forbidden.

Fix

The proxy now removes the incoming Cookie header before constructing the
target request. It then restores Cookie only when the caller explicitly
provides a non-empty X-Sender-Cookie.

This keeps proxy-origin state isolated while preserving the existing contract
for target-specific authenticated requests.

Why file-server

Runframe supplies target headers through the X-Sender-* contract, and the CLI
mounts file-server's proxy route. File-server is the component that converts
the browser request into the target request, so it is the shared boundary that
must distinguish proxy-origin cookies from target cookies.

Validation

• bun test tests/routes/proxy.test.ts tests/routes/file-proxy03.test.ts — 9
  pass, 0 fail
• bun test --max-concurrency=1 — 31 pass, 0 fail
• bun run format:check — passes
• bunx tsc --noEmit — passes
• bun run build — passes

The repository's default concurrent full-suite run also exposed an unrelated
pre-existing test-isolation flake in the events/file-proxy tests; the affected
tests pass when isolated and the proxy regression is consistently green.