fix: correct expired DeepSeek prices, enforce curated expiries, harden Host + sync lock

[pitimon]

Summary

Two independent fixes from a Fable-model QA review of 0.39.40, kept in one PR because both are small and touch nothing in common. One commit each.

• Pricing data (Expired DeepSeek v4-pro promo prices still active; curated expiries are not machine-checked #87) — deepseek-v4-pro was still pinned to its 75%-off launch promo 55 days after the promo ended, billing every DeepSeek row at 25% of true cost. The file documented its own cutover date in prose and nothing read it. Rates corrected, and the free-text _meta.*_expiry keys are replaced with a structured _meta.expiries array that ci:local now enforces — including the Sonnet 5 2026-08-31 cutover that was queued up to repeat the same failure.
• Loopback hardening (No Host-header validation: DNS rebinding can read all dashboard data #88) — binding to 127.0.0.1 does not make the Host header trustworthy. Under DNS rebinding a browser sends Host: attacker.example to loopback and treats the response as same-origin, so CORS never applies. Mutations were already gated on a loopback Origin, but every GET /functions/* endpoint was readable by any page the victim had open. Non-loopback hosts now get a 403 before any routing.
• Sync lock (Sync lock: 5-min staleness with no heartbeat, plus stale-takeover TOCTOU #89) — the lock had a 5-minute staleness window and never refreshed its own mtime, while local-sync fires on an interval. Any sync longer than one tick (full-corpus rebuilds, migration reparses) had its lock stolen, letting two writers interleave appends into queue.jsonl; a torn line is silently skipped by the reader, and a skipped retraction row is a permanent overcount. Now heartbeated, with an atomic takeover.

Why these three, in this shape

A stale price is worse than a missing one: a missing price shows $0 and looks broken, a stale price looks fine forever. Both #87 and the recent claude-opus-5 $0 incident come from the same place — a pricing fact that depends on a human remembering something — so the fix is a check, not a corrected number.

Two implementation notes worth reviewing:

1. The request handler moved out of cmdServe into createRequestHandler. That is what lets the test boot a real http.Server and assert the API handler is never reached on a rebound host. A guard that exists but is never wired is precisely the failure mode being prevented, so a predicate-only test would not have been worth much.
2. The lock takeover uses an atomic mkdir mutex, not a rename. A rename-based claim was written first and still failed a 4-way race test with 2 winners: rename is atomic, but it does not bind the staleness check to the act, so a waiter that stat'd earlier can rename away the winner's freshly created lock. The mkdir mutex puts the re-check and the delete in the same critical section.

Test plan

• npm run ci:local green end to end (dashboard build + dashboard suite + 794 root tests + all validators)
• test/curated-expiry.test.js — 13 cases: not-yet-expired, expired, inclusive UTC-midnight boundary, missing/blank fields, malformed and impossible dates (2026-02-31), duplicate ids, regression to free-text *_expiry, non-array, non-object entries, plus a numeric pin on the corrected DeepSeek rates
• test/host-header-guard.test.js — 7 cases against a real server: rebound host 403s and the API handler is never invoked, OPTIONS preflight also rejected, all four loopback spellings pass on an arbitrary port, lookalikes rejected (127.0.0.1.attacker.example, localhost:17680@attacker.example), absent Host allowed, malformed Host rejected rather than thrown
• test/sync-lock.test.js — 9 cases: owner recorded, release removes the file, a live holder is not stolen past the old 5-minute window, heartbeat advances mtime, release stops the heartbeat, expired lock reclaimed, dead-owner lock reclaimed immediately, another host's lock left alone, corrupt lock falls back to the mtime rule, and exactly one winner in a concurrent takeover
• Race stress outside the suite: 50 rounds × 8 concurrent racers on one stale lock — exactly one winner every round, no mutex left behind
• npm run validate:curated-expiry passes today and fails on a backdated entry
• Reviewer: confirm the 30-minute stale window is acceptable given the new dead-owner fast path (a killed holder is now reclaimed immediately rather than after the window, so recovery is faster than before, not slower)

Not in this PR

The systemic pricing fix — no in-process refresh, unknown models billing $0, invisible fuzzy tiers — is #90, deliberately separate because it touches the pricing path that just had a live incident and deserves an isolated diff.

Closes #87
Closes #88
Closes #89