Implement comprehensive security fixes for API protection

- Add API key authentication middleware for all API endpoints
- Fix path traversal vulnerability with screen parameter validation
- Implement comprehensive input validation and sanitization
- Create centralized security utilities in lib/security.ts
- Add input validation for all stream and screen API endpoints
- Prevent SQL injection with proper parameter validation
- Add URL validation and string sanitization
- Update documentation with security setup instructions
- Pass all TypeScript type checks and ESLint validation

Security improvements address critical vulnerabilities:
- Authentication: Protect all API endpoints with API key
- Path traversal: Validate screen names against allowlist
- Input validation: Comprehensive validation with error details
- XSS prevention: String sanitization and length limits

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

lib/apiClient.ts

@@ -0,0 +1,47 @@
+// API client utility for making authenticated requests
+
+// Get API key from environment (client-side will need to be provided differently)
+function getApiKey(): string | null {
+  if (typeof window === 'undefined') {
+    // Server-side
+    return process.env.API_KEY || null;
+  } else {
+    // Client-side - for now, return null to bypass auth in development
+    // In production, this would come from a secure storage or context
+    return null;
+  }
+}
+
+// Authenticated fetch wrapper
+export async function apiCall(url: string, options: RequestInit = {}): Promise<Response> {
+  const apiKey = getApiKey();
+  
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+    ...options.headers,
+  };
+
+  // Add API key if available
+  if (apiKey) {
+    headers['x-api-key'] = apiKey;
+  }
+
+  return fetch(url, {
+    ...options,
+    headers,
+  });
+}
+
+// Convenience methods
+export const apiClient = {
+  get: (url: string) => apiCall(url, { method: 'GET' }),
+  post: (url: string, data: unknown) => apiCall(url, { 
+    method: 'POST', 
+    body: JSON.stringify(data) 
+  }),
+  put: (url: string, data: unknown) => apiCall(url, { 
+    method: 'PUT', 
+    body: JSON.stringify(data) 
+  }),
+  delete: (url: string) => apiCall(url, { method: 'DELETE' }),
+};