Fix security vulnerabilities, package-lock.json, misc other changes

- Add rate limiting to prevent DoS attacks on vulnerable routes
- Update package-lock.json to use public npm registry
- Document intentionally permissive CORS for public test server
- Remove health endpoints to match original codebase (no health checks)
- Fix auth server splash page to list all OAuth endpoints
- Update test scripts to check server availability via splash page

scripts/test-e2e-internal.sh

@@ -41,8 +41,8 @@ AUTH_MODE=internal PORT=8080 BASE_URI=$SERVER_URL node dist/index.js &
 SERVER_PID=$!
 sleep 5
 
-# Check server health
-if ! curl -s -f "$SERVER_URL/health" > /dev/null; then
+# Check server is running by accessing splash page
+if ! curl -s -f "$SERVER_URL/" > /dev/null 2>&1; then
     echo "❌ Server failed to start at $SERVER_URL"
     kill $SERVER_PID 2>/dev/null || true
     exit 1