feat: content fetch, sitemap fixes, remove oidcAuthFlow

- Add contentFetchFlow() to proxy (FR-001 through FR-012)
- Add extractArticleBody() helper with vkm:articleBody / articleBody fallback
- Dynamic proxyBaseUrl derivation from x-forwarded-proto/host headers
- Forward query/size/category params on /sitemap.xml requests
- Add Accept: application/ld+json header to content API calls
- Remove oidcAuthFlow() - unmatched requests now return 404 Not Found
- Fix xmlbuilder2 import: default import, call as xmlbuilder2.create(...)
- Version bump 0.2.0 → 0.3.0
- 45/45 tests passing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

specs/001-oidc-proxy-script/contracts/vm-context.md

@@ -120,7 +120,7 @@ These are injected by `server.js` (`globalVMContext`) and are available to proxy
 | `crypto` | Web Crypto API | No UUID or crypto ops in this script |
 | `jwt` | jsonwebtoken | No JWT signing/verification needed |
 | `uuidv4` | uuid function | No request-ID generation needed |
-| `xmlBuilder` | xmlbuilder2 | No XML output |
+| `xmlbuilder2` | xmlbuilder2 | No XML output |
 
 ---
 
@@ -136,7 +136,7 @@ const globalVMContext = {
   axios,                 // ← used by proxy.js
   uuidv4,
   jwt,
-  xmlBuilder,
+  xmlbuilder2,
   redis,                 // ← used by proxy.js (token cache)
 };