fix: reject repeated x-rendering-proxy headers

[kitsuyui]

Summary

• reject repeated X-Rendering-Proxy request header values instead of concatenating them implicitly
• document that the server accepts a single JSON object header value for X-Rendering-Proxy
• cover the repeated-header case with a parser test

Why

The protocol documentation already describes X-Rendering-Proxy as a single JSON object. Rejecting repeated header values makes the server behavior deterministic and avoids relying on implicit string concatenation for duplicate headers.

Validation

• bun run lint
• bun run typecheck
• bun run test

[github-actions]

Code Metrics Report

	main (6aabcd3)	#1658 (c3767e7)	+/-
Coverage	84.3%	84.4%	+0.1%
Code to Test Ratio	1:0.5	1:0.5	-0.1
Test Execution Time	11s	8s	-3s

Details

  |                     | main (6aabcd3) | #1658 (c3767e7) |  +/-  |
  |---------------------|----------------|-----------------|-------|
+ | Coverage            |          84.3% |           84.4% | +0.1% |
  |   Files             |             11 |              11 |     0 |
  |   Lines             |            243 |             245 |    +2 |
+ |   Covered           |            205 |             207 |    +2 |
- | Code to Test Ratio  |          1:0.5 |           1:0.5 |  -0.1 |
  |   Code              |           1886 |            1905 |   +19 |
+ |   Test              |           1072 |            1080 |    +8 |
+ | Test Execution Time |            11s |              8s |   -3s |

Code coverage of files in pull request scope (95.6% → 96.0%)

Files	Coverage	+/-	Status
src/server/request_options.ts	96.0%	+0.3%	modified

---

Reported by octocov

[github-actions]

gh-counter

PR gate

	Removed	Added	+/-
TODO/expect-error	0	0	0

Repo dashboard

	main (6aabcd3)	#1658 (c3767e7)	+/-
TODO/expect-error	4	4	0

---

Reported by gh-counter