Release v3.8.40

v3.8.40 cycle integration → main. All test gates green (Unit/Integration/Coverage/Node-compat/Quality-Ratchet). The only red check, 'PR Test Policy', is the test-masking heuristic firing on the cumulative ~57-commit release diff (legitimate assert consolidations already reviewed per-PR — Gemini CLI removal #5246, retired GPT models #5280, provider catalog refreshes); overridden with --admin per the documented release-PR convention. CodeQL/SonarQube advisory scans non-blocking; #5278's code already passed CodeQL on main. Homologated on VPS 192.168.0.15 (v3.8.40 healthy).

package.json

@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "3.8.39",
+  "version": "3.8.40",
   "description": "Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.",
   "type": "module",
   "bin": {
@@ -25,6 +25,7 @@
     "bin/cli/runtime/",
     "scripts/postinstall.mjs",
     "scripts/build/postinstallSupport.mjs",
+    "scripts/build/runtime-env.mjs",
     "scripts/build/colocateOptionals.mjs",
     "scripts/build/sync-env.mjs",
     "scripts/dev/responses-ws-proxy.mjs",
@@ -32,6 +33,7 @@
     "scripts/dev/sync-env.mjs",
     "scripts/build/native-binary-compat.mjs",
     "scripts/build/build-next-isolated.mjs",
+    "scripts/build/runtime-env.mjs",
     "README.md",
     "LICENSE",
     "!**/__tests__/**",
@@ -221,6 +223,7 @@
     "clsx": "^2.1.1",
     "commander": "^15.0.0",
     "csv-stringify": "^6.7.0",
+    "dompurify": "^3.4.11",
     "express": "^5.2.1",
     "fetch-socks": "^1.3.3",
     "fflate": "^0.8.3",
@@ -295,10 +298,8 @@
     "@tailwindcss/postcss": "^4.3.0",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
-    "@types/bcryptjs": "^3.0.0",
     "@types/better-sqlite3": "^7.6.13",
     "@types/bun": "latest",
-    "@types/keytar": "^4.4.2",
     "@types/node": "^26.0.0",
     "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
@@ -362,6 +363,9 @@
     "protobufjs": "^7.6.3",
     "@babel/core": "^7.29.6",
     "hono": "^4.12.25",
+    "@yarnpkg/parsers": {
+      "js-yaml": "^4.2.0"
+    },
     "jsdom": {
       "undici": "^7.28.0"
     },