[P2] Medium/low coverage gaps and weak tests from adversarial sweep (RSS/Checkout/Auth)

## Summary
Adversarial test sweep found a number of medium- and low-priority coverage gaps and weak tests across RSS-Proxy, Checkout, and Auth. None represent confirmed current defects, but regressions would not be caught.

## RSS-Proxy (medium)
- Missing/malformed `url` parameter — `api/rss-proxy.js:113-130`
- Method/OPTIONS handling — `api/rss-proxy.js:97-103`
- Disallowed origin — `api/rss-proxy.js:91-95`
- Relay-only routing + cache policy — `api/rss-proxy.js:13-32`, `:141`, `:178-215`
- Google News timeout selection — `api/rss-proxy.js:66-71`, `:143-145`
- Timeout `AbortError` → 504 mapping — `api/_relay.js:26-33`, `api/rss-proxy.js:219-235`
- Non-2xx direct-response relay fallback — `api/rss-proxy.js:193-198`
- Content-type fallback + cache headers — `api/rss-proxy.js:201-218`

## Checkout (medium)
- Retryable-status set is tautologically tested — `src/services/checkout-transport.ts:26`
- Retry request body/equivalence unasserted.
- Final retry `Response` identity/body/headers unasserted; no active 502→200 integration.
- Exact pending-payment TTL boundary untested — `convex/payments/billing.ts:1993-2006`
- Exact cancelled paid-through period-end boundary untested — `convex/payments/billing.ts:1755-1769`
- Equal-timestamp lifecycle ordering policy untested — `convex/payments/subscriptionHelpers.ts:121-130`
- Dodo timeout/retry mock contract weak — `convex/payments/billing.ts:1904-1909`
- Concurrent webhook exactly-once behavior only has temporary evidence.

## Auth (medium/low)
- Empty cached `userId` accepted — `api/_user-api-key.js:215-218`
- User-key request coalescing removal unguarded — `api/_user-api-key.js:118-129,203-210`
- Convex `AbortSignal` timeout in user-key path not asserted — `api/_user-api-key.js:174-190`
- MCP authenticated per-minute limiter not exercised — `api/mcp/auth.ts:370-400`
- MCP anonymous discovery limiter not exercised — `api/mcp/auth.ts:410-417`
- Secret-compare regex misses identifiers like `probeSecret !== expectedSecret` — `tests/no-non-timing-safe-secret-compare.test.mts:29-32,70-73`
- Weak tests staying green under mutation:
- Remove issuer from no-aud JWT fallback — `server/auth-session.ts:118-121`
- Null organization extraction — `server/auth-session.ts:68-74,144`
- Remove explicit missing-secret guard — `server/_shared/internal-auth.ts:62-65`
- Remove `wm_` prefix validator — `server/_shared/user-api-key.ts:35`
- Omit `__resetWmSessionForTests()` in reset-timeout test
- Force broad secret scan `files=[]` — `tests/no-non-timing-safe-secret-compare.test.mts:59-60,89-94`

## Test-infra note
- Vitest census requires `--reporter=tap` for machine-readable skip/fail parsing.

## Suggested fix
Pick off these gaps with regression tests that fail before the fix and pass after.

Choose one gap from the listed RSS-Proxy, Checkout, or Auth entry points, then read the referenced implementation and existing tests. Run the relevant Vitest tests with --reporter=tap. Done means the selected regression case is covered and fails before the corresponding fix but passes afterward.

Written by the indexing model from the issue text.