refactor: modularize codebase — deduplicate, extract, clean up

- Unify duplicate uTLS transports into shared internal/transport package
- Extract shared version constant into internal/version
- Move LoadDefaultCredentials from config to auth (remove config→auth import)
- Deduplicate handler.go: extract telemetry/error helpers (324→268 lines)
- Break up main.go::run() into initCredential/initEmbedded
- Eliminate logging.Config duplication (use config.LoggingConfig directly)
- Extract logWriter to embedded/log.go, SSE fixtures to consts in sniff.go
- Use uTLS client for usage polling (consistent TLS fingerprint)
- Handle sjson.SetBytes errors in sanitize.go instead of silently swallowing
- Document reverse-engineered magic values in billing.go
- Unexport Credential.CooldownUntil (internal state)
- Replace hardcoded auth bypass paths with map in server.go

internal/proxy/sanitize.go

@@ -4,6 +4,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/rs/zerolog/log"
 	"github.com/tidwall/gjson"
 	"github.com/tidwall/sjson"
 
@@ -11,10 +12,10 @@ import (
 )
 
 type Sanitizer struct {
-	toolsForward  map[string]string
-	toolsReverse  map[string]string
-	systemRules   []config.ReplaceRule
-	bodyRules     []config.ReplaceRule
+	toolsForward map[string]string
+	toolsReverse map[string]string
+	systemRules  []config.ReplaceRule
+	bodyRules    []config.ReplaceRule
 }
 
 func NewSanitizer(cfg config.SanitizeConfig) *Sanitizer {
@@ -49,7 +50,11 @@ func (s *Sanitizer) DesanitizeResponse(body []byte) []byte {
 		}
 		name := block.Get("name").String()
 		if orig, ok := s.toolsReverse[name]; ok {
-			body, _ = sjson.SetBytes(body, "content."+strconv.Itoa(i)+".name", orig)
+			if b, err := sjson.SetBytes(body, "content."+strconv.Itoa(i)+".name", orig); err != nil {
+				log.Warn().Err(err).Str("tool", name).Msg("desanitize response: set name failed")
+			} else {
+				body = b
+			}
 		}
 	}
 	return body
@@ -64,8 +69,12 @@ func (s *Sanitizer) DesanitizeStreamEvent(line string) string {
 	for _, path := range []string{"content_block.name", "delta.name"} {
 		name := gjson.GetBytes(data, path).String()
 		if orig, ok := s.toolsReverse[name]; ok {
-			data, _ = sjson.SetBytes(data, path, orig)
-			changed = true
+			if b, err := sjson.SetBytes(data, path, orig); err != nil {
+				log.Warn().Err(err).Str("tool", name).Msg("desanitize stream event: set name failed")
+			} else {
+				data = b
+				changed = true
+			}
 		}
 	}
 	if changed {
@@ -85,7 +94,11 @@ func (s *Sanitizer) renameTools(body []byte) []byte {
 	for i, tool := range tools.Array() {
 		name := tool.Get("name").String()
 		if newName, ok := s.toolsForward[name]; ok {
-			body, _ = sjson.SetBytes(body, "tools."+strconv.Itoa(i)+".name", newName)
+			if b, err := sjson.SetBytes(body, "tools."+strconv.Itoa(i)+".name", newName); err != nil {
+				log.Warn().Err(err).Str("tool", name).Msg("rename tool failed")
+			} else {
+				body = b
+			}
 		}
 	}
 	return body
@@ -104,7 +117,11 @@ func (s *Sanitizer) replaceSystem(body []byte) []byte {
 		for _, rule := range s.systemRules {
 			text = strings.ReplaceAll(text, rule.Match, rule.Replace)
 		}
-		body, _ = sjson.SetBytes(body, "system."+strconv.Itoa(i)+".text", text)
+		if b, err := sjson.SetBytes(body, "system."+strconv.Itoa(i)+".text", text); err != nil {
+			log.Warn().Err(err).Int("block", i).Msg("replace system text failed")
+		} else {
+			body = b
+		}
 	}
 	return body
 }