feat: content fetch, sitemap fixes, remove oidcAuthFlow

- Add contentFetchFlow() to proxy (FR-001 through FR-012)
- Add extractArticleBody() helper with vkm:articleBody / articleBody fallback
- Dynamic proxyBaseUrl derivation from x-forwarded-proto/host headers
- Forward query/size/category params on /sitemap.xml requests
- Add Accept: application/ld+json header to content API calls
- Remove oidcAuthFlow() - unmatched requests now return 404 Not Found
- Fix xmlbuilder2 import: default import, call as xmlbuilder2.create(...)
- Version bump 0.2.0 → 0.3.0
- 45/45 tests passing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -91,7 +91,7 @@ All dependencies are injected into each request's sandbox:
 | `axios` | HTTP client |
 | `jwt` | `jsonwebtoken` |
 | `uuidv4` | UUID v4 generator |
-| `xmlBuilder` | `xmlbuilder2` `create` |
+| `xmlbuilder2` | `xmlbuilder2` `create` |
 | `redis` | Connected Redis client |
 | `URLSearchParams`, `URL` | Node.js globals |
 | `kme_CSA_settings` | Loaded from `src/globalVariables/kme_CSA_settings.json` |