Merge remote-tracking branch 'upstream/main' into pr-70

# Conflicts:
#	src/config/index.ts
#	src/llm/index.ts
#	src/server.ts
#	src/setup.ts
#	src/types/index.ts

.env.example

@@ -12,6 +12,16 @@ TOGETHER_API_KEY=
 HUGGINGFACE_TOKEN=
 REPLICATE_API_TOKEN=
 
+# ── Target authentication (both values are required) ──
+# Exact origin that may receive the configured headers (scheme + host + optional port).
+# TEMPEST_TARGET_ORIGIN=https://target.example
+# JSON object of headers injected into HTTP requests to that exact origin.
+# Explicit per-request headers override these defaults case-insensitively.
+# Bearer token:   TEMPEST_TARGET_HEADERS={"Authorization":"Bearer eyJhbGc..."}
+# Cookie:         TEMPEST_TARGET_HEADERS={"Cookie":"session=abc123"}
+# Multiple:       TEMPEST_TARGET_HEADERS={"Authorization":"Bearer token","X-Tenant":"acme"}
+# TEMPEST_TARGET_HEADERS=
+
 # ── GitHub (xbow-bench challenge fetch / gh operations) ──
 GITHUB_TOKEN=