Fix/neon db connectivity - #80

- openBrowser: reject URLs not starting with http:// or https://
- openBrowser: fix Windows cmd /c start to pass empty title arg
- sanitizeUrlPath: decode URI-encoded paths before validation
- sanitizeUrlPath: block backslash characters in paths
- sanitizeUrlPath: collapse consecutive slashes

When token lengths differ, perform a constant-time comparison on
equal-length dummy buffers before returning false, preventing a
timing side-channel that could leak length information.

- Extract duplicated HTTP proxy logic into createOpencodeProxy()
- Switch proxy body handling from buffer-then-forward to streaming
- Use async execFile for cloudflared tunnel creation
- Harden sanitizeUrlPath with decodeURIComponent and backslash blocking

- Replace execFileSync with async execFile wrapper in port detection
- Convert getListeningPorts to async for non-blocking port scanning
- Remove verbose keypress debug logging
- Remove unused deriveProjectId export from tunnel-client

- Remove channel_binding=require from DATABASE_URL (unsupported by Neon pooler)
- Increase connect_timeout from 10s to 30s for Neon cold starts
- Apply same connect_timeout fix to tunnel-server

Co-authored-by: muse-spark-1.2 <muse-spark@users.noreply.github.com>