Antigravity-Review-Fixes: Traversal-Guard, Client-Pooling, Cache-Lock, Doku

Vier verifizierte Befunde aus dem externen Review (Gemini 3.1 Pro):
- app.py: SPA-Fallback gegen Path-Traversal gehaertet (resolve + is_relative_to,
  liefert nur noch Dateien INNERHALB von frontend/dist aus).
- app.py/gateway_proxy.py: geteilter httpx.AsyncClient im lifespan statt neuer
  Client pro /v1-Anfrage (Keep-Alive/Pooling, spart Sockets unter parallelen Agent-Stroemen).
- system.py: check_versions_cached() mit threading.Lock + Double-Check gegen Scan-Stampede.
- AGENTS.md: Zeitzonen-Drift korrigiert (Box laeuft Europe/Berlin, nicht UTC).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/gateway_proxy.py

@@ -1,6 +1,5 @@
 import os
 
-import httpx
 from fastapi import APIRouter, Request
 from fastapi.responses import JSONResponse, StreamingResponse
 
@@ -97,20 +96,19 @@ async def _proxy(path: str, request: Request):
     _inject_language(body, alias)
     url = f"{LLAMA_SWAP_URL}{path}"
 
+    client = request.app.state.gw_client  # geteilter Keep-Alive-Client (siehe app.py lifespan)
     if body.get("stream"):
         async def gen():
-            async with httpx.AsyncClient(timeout=None) as c:
-                async with c.stream("POST", url, json=body) as r:
-                    async for chunk in r.aiter_raw():
-                        record_stream_chunk(chunk, alias)
-                        yield chunk
+            async with client.stream("POST", url, json=body, timeout=None) as r:
+                async for chunk in r.aiter_raw():
+                    record_stream_chunk(chunk, alias)
+                    yield chunk
         return StreamingResponse(gen(), media_type="text/event-stream", headers=routed)
 
-    async with httpx.AsyncClient(timeout=600) as c:
-        r = await c.post(url, json=body)
-        resp_json = r.json()
-        record_usage(resp_json.get("usage") if isinstance(resp_json, dict) else None, alias)
-        return JSONResponse(resp_json, status_code=r.status_code, headers=routed)
+    r = await client.post(url, json=body, timeout=600.0)
+    resp_json = r.json()
+    record_usage(resp_json.get("usage") if isinstance(resp_json, dict) else None, alias)
+    return JSONResponse(resp_json, status_code=r.status_code, headers=routed)
 
 
 @router.post("/chat/completions")