- fix getEndpoint() fallback to URL from annotation and reading defaultConfig/label from definition
- fix Anthropic authentication (x-api-key via authentication service, not hardcoded Authorization)
- fix message order in createMessages() and response validation in ApiRequestService
- security: sanitize key from Key module, MCP dns_get_record + allow_redirects=FALSE, lazy Apify token
- prompt-injection filter only detects and logs, does not mutate content
- added config schema and install defaults, key.repository as hard dependency
