Fixes, readme

Drop cli-proxy-api token handling, use only native Claude credentials.
Simplify refresh to single endpoint (platform.claude.com) with scope.
Add debug/refresh and debug/shutdown endpoints. Graceful shutdown.

internal/server/server.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"strings"
 	"sync/atomic"
+	"time"
 
 	"github.com/gin-gonic/gin"
 
@@ -45,6 +46,8 @@ func New(cfg *config.Config, pool *auth.Pool, profile *proxy.SniffedProfile) *Se
 	engine.POST("/messages", handler)
 
 	engine.POST("/reload", s.handleReload())
+	engine.POST("/debug/refresh", handleDebugRefresh(pool))
+	engine.POST("/debug/shutdown", handleDebugShutdown(s))
 	engine.GET("/healthz", func(c *gin.Context) {
 		c.JSON(http.StatusOK, gin.H{"status": "ok"})
 	})
@@ -97,6 +100,26 @@ func (s *Server) handleReload() gin.HandlerFunc {
 	}
 }
 
+func handleDebugShutdown(s *Server) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"status": "shutting down"})
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			if err := s.Shutdown(ctx); err != nil {
+				log.Printf("shutdown error: %v", err)
+			}
+		}()
+	}
+}
+
+func handleDebugRefresh(pool *auth.Pool) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		results := pool.RefreshAll(c.Request.Context())
+		c.JSON(http.StatusOK, results)
+	}
+}
+
 func makeKeySet(apiKeys []string) map[string]struct{} {
 	keySet := make(map[string]struct{}, len(apiKeys))
 	for _, k := range apiKeys {
@@ -123,7 +146,7 @@ func corsMiddleware() gin.HandlerFunc {
 func (s *Server) authMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		path := c.Request.URL.Path
-		if path == "/healthz" || path == "/reload" {
+		if path == "/healthz" || path == "/reload" || strings.HasPrefix(path, "/debug/") {
 			c.Next()
 			return
 		}