refactor(phase5-6): domain persistence, policy engine, OAuth extraction, proxy decoupling

Phase 5 — Foundation & Security:
- SQLite domain state persistence (5 tables, 4 modules: fallback, budget, lockout, circuit breaker)
- Write-through cache pattern for state survival across restarts
- Race condition fix in route.js (Promise-based singleton)
- Default password hardening (.env.example)
- Server init error handling improvement

Phase 6 — Architecture Refactoring:
- OAuth providers extracted into 12 individual modules (providers.js 1051→144 lines)
- Policy Engine (lockout→budget→fallback) with evaluateRequest/evaluateFirstAllowed
- Deterministic round-robin via persistent counter Map
- Telemetry window fix with proper recordedAt timestamps
- Proxy decoupled from API settings (direct import vs HTTP self-fetch)

Tests: 295 pass (22 new: domain-persistence 16, policy-engine 6)
Docs: CHANGELOG, README, ARCHITECTURE.md updated

.env.example

@@ -9,8 +9,8 @@ JWT_SECRET=
 # Generate with: openssl rand -hex 32
 API_KEY_SECRET=
 
-# Initial admin password (change after first login)
-INITIAL_PASSWORD=123456
+# Initial admin password — CHANGE THIS before first use!
+INITIAL_PASSWORD=CHANGEME
 DATA_DIR=/var/lib/omniroute
 
 # Storage (SQLite)