Fix SonarQube issues, store sessions in Redis, use direct analytics URLs

- ApiSandboxController: reduce scan() returns from 4 to 3 via ternary
- ApiDocController: add MIME_JSON constant, extract buildInsomniaRequest()
  and buildInsomniaBody() to reduce cognitive complexity
- Store sessions in Redis to fix SSO disconnect with 2 PHP replicas
  (round-robin load balancing caused session loss on filesystem storage)
- Configure session cookie: 24h lifetime, secure auto, samesite lax
- Replace Caddy analytics proxies (/stats/*, /assets/perf.js, /sperf)
  with direct URLs to tools-security.esy-web.dev and cloudflareinsights.com
- Update JS tests for new direct analytics URLs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

assets/modules/cookie-consent.js

@@ -24,9 +24,9 @@ function loadAnalytics() {
 
     const script = document.createElement('script')
     script.defer = true
-    script.src = '/stats/script.js'
+    script.src = 'https://tools-security.esy-web.dev/script.js'
     script.dataset.websiteId = 'a1f85dd5-741f-4df7-840a-7ef0931ed0cc'
-    script.dataset.hostUrl = '/stats'
+    script.dataset.hostUrl = 'https://tools-security.esy-web.dev'
     script.dataset.analytics = '1'
     document.head.appendChild(script)
 
@@ -40,7 +40,7 @@ function loadCloudflareTunnel() {
 
     const script = document.createElement('script')
     script.defer = true
-    script.src = '/assets/perf.js'
+    script.src = 'https://static.cloudflareinsights.com/beacon.min.js'
     script.dataset.cfBeacon = '{"token":"5f2f3b8e1f824be6984a348fe31d2f04","spa":true}'
     document.head.appendChild(script)
 }