feat: content fetch, sitemap fixes, remove oidcAuthFlow

- Add contentFetchFlow() to proxy (FR-001 through FR-012)
- Add extractArticleBody() helper with vkm:articleBody / articleBody fallback
- Dynamic proxyBaseUrl derivation from x-forwarded-proto/host headers
- Forward query/size/category params on /sitemap.xml requests
- Add Accept: application/ld+json header to content API calls
- Remove oidcAuthFlow() - unmatched requests now return 404 Not Found
- Fix xmlbuilder2 import: default import, call as xmlbuilder2.create(...)
- Version bump 0.2.0 → 0.3.0
- 45/45 tests passing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

specs/002-sitemap-generation/quickstart.md

@@ -118,9 +118,9 @@ Contract tests live in `tests/contract/proxy-http.test.js`.
 - **No new files**: All new logic is added directly to
   `src/proxyScripts/kmeContentSourceAdapter.js` (monolithic architecture constraint).
 - **No new dependencies**: `xmlbuilder2` is already in `package.json` and injected into the
-  VM context as `xmlBuilder`.
+  VM context as `xmlbuilder2`.
 - **Token reuse**: The sitemap flow reuses the existing Redis `hGet`/token-refresh pattern —
   no separate auth logic.
 - **VM isolation**: The proxy script runs in a `vm.createContext` sandbox. It has access only
-  to the injected globals listed in `src/server.js` (`axios`, `redis`, `xmlBuilder`,
+  to the injected globals listed in `src/server.js` (`axios`, `redis`, `xmlbuilder2`,
   `kme_CSA_settings`, `req`, `res`, `console`, `URLSearchParams`, `URL`, `crypto`).