[security] Secure-by-default LLM API intermediary: implement fail-closed gate + anomaly screening + transparency log per arXiv:2604.08407