feat: P1 보안/성능 개선 및 마이그레이션 자동화

Security fixes:
- migrate.ts: SQL/Command Injection 방지 (spawnSync 사용)
- migrate.ts: Path Traversal 검증 추가
- api-tester.ts: API 키 마스킹 (4자만 노출)
- api-tester.ts: 최소 16자 키 길이 검증
- cache.ts: ReDoS 방지 (패턴 길이/와일드카드 제한)

Performance improvements:
- cache.ts: 순차 삭제 → 병렬 배치 처리 (50개씩)
- cache.ts: KV 등록 fire-and-forget (non-blocking)
- cache.ts: 메모리 제한 (5000키)
- cache.ts: 25초 실행 시간 가드
- cache.ts: 패턴 매칭 prefix 최적화

New features:
- 마이그레이션 자동화 시스템 (scripts/migrate.ts)
- KV 기반 캐시 인덱스 (invalidatePattern, clearAll)
- 글로벌 CacheService 싱글톤

Other:
- .env.example 추가, API 키 환경변수 처리
- CACHE_TTL.RECOMMENDATIONS (10분) 분리
- e2e-tester.ts JSON 파싱 에러 핸들링 개선

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/routes/instances.ts

@@ -7,7 +7,7 @@
 
 import type { Env, InstanceQueryParams } from '../types';
 import { QueryService } from '../services/query';
-import { CacheService } from '../services/cache';
+import { getGlobalCacheService } from '../services/cache';
 import { logger } from '../utils/logger';
 import {
   SUPPORTED_PROVIDERS,
@@ -31,7 +31,6 @@ import {
  * Note: Worker instances are recreated periodically, preventing memory leaks
  */
 let cachedQueryService: QueryService | null = null;
-let cachedCacheService: CacheService | null = null;
 let cachedDb: D1Database | null = null;
 
 /**
@@ -49,18 +48,6 @@ function getQueryService(db: D1Database, env: Env): QueryService {
   return cachedQueryService;
 }
 
-/**
- * Get or create CacheService singleton
- * Lazy initialization on first request, then reused for subsequent requests
- */
-function getCacheService(): CacheService {
-  if (!cachedCacheService) {
-    cachedCacheService = new CacheService(CACHE_TTL.INSTANCES);
-    logger.debug('[Instances] CacheService singleton initialized');
-  }
-  return cachedCacheService;
-}
-
 /**
  * Parsed and validated query parameters
  */
@@ -359,8 +346,8 @@ export async function handleInstances(
     const params = parseResult.params!;
     logger.info('[Instances] Query params validated', params as unknown as Record<string, unknown>);
 
-    // Get cache service singleton (reused across requests)
-    const cacheService = getCacheService();
+    // Get global cache service singleton (shared across all routes)
+    const cacheService = getGlobalCacheService(CACHE_TTL.INSTANCES, env.RATE_LIMIT_KV);
 
     // Generate cache key from query parameters
     const cacheKey = cacheService.generateKey(params as unknown as Record<string, unknown>);