feat: content fetch, sitemap fixes, remove oidcAuthFlow

- Add contentFetchFlow() to proxy (FR-001 through FR-012)
- Add extractArticleBody() helper with vkm:articleBody / articleBody fallback
- Dynamic proxyBaseUrl derivation from x-forwarded-proto/host headers
- Forward query/size/category params on /sitemap.xml requests
- Add Accept: application/ld+json header to content API calls
- Remove oidcAuthFlow() - unmatched requests now return 404 Not Found
- Fix xmlbuilder2 import: default import, call as xmlbuilder2.create(...)
- Version bump 0.2.0 → 0.3.0
- 45/45 tests passing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.specify/memory/constitution.md

@@ -295,7 +295,7 @@ Follow-up TODOs:
 - ✅ `crypto` - Web Crypto API for randomUUID()
 - ✅ `axios` - HTTP client for API calls
 - ✅ `jwt` - JSON Web Token library for authentication
-- ✅ `xmlBuilder` - XML document builder
+- ✅ `xmlbuilder2` - XML document builder
 - ✅ `uuidv4` - UUID generator
 - ✅ `redis` - Redis client for token caching and shared state
 - ✅ `adapterHelper` - Helper functions (loaded from src/globalVariables/)
@@ -440,7 +440,7 @@ const globalVMContext = {
   axios,
   uuidv4,
   jwt,
-  xmlBuilder,
+  xmlbuilder2,
   redis,  // Connected Redis client for token caching
 };
 
@@ -501,11 +501,11 @@ script.runInContext(context);
    - Package: `jsonwebtoken`
    - Injected from: `globalVMContext.jwt`
 
-6. **xmlBuilder** - XML builder/generator
+6. **xmlbuilder2** - XML builder/generator
    - Purpose: Constructing XML documents programmatically
-   - Usage: `xmlBuilder({ root: { child: 'value' } })`
+   - Usage: `xmlbuilder2({ root: { child: 'value' } })`
    - Package: `xmlbuilder2` (create function)
-   - Injected from: `globalVMContext.xmlBuilder`
+   - Injected from: `globalVMContext.xmlbuilder2`
 
 7. **redis** - Redis client
    - Purpose: Token caching and shared state across requests