Remove .idea from VCS, use explicit CSPRNG, fix cross-platform fallback paths

[Copilot]

Addresses three review findings: committed IDE config, unclear RNG security posture, and Unix-style hardcoded fallback paths.

• .idea/ removed from git, added to .gitignore

• Explicit CSPRNG for key generation — replaced rand::rng() (ThreadRng) with StdRng::from_os_rng() across all three call sites in keys.rs. SecretKey::generate already enforces CryptoRng at compile time, but the previous code made reviewers second-guess the security properties. StdRng::from_os_rng() is unambiguous: ChaCha12 seeded directly from OS entropy.

// before
let mut rng = rand::rng();
let sk = SecretKey::generate(&mut rng);

// after
let sk = SecretKey::generate(&mut StdRng::from_os_rng());

• Platform-aware fallback paths — replaced string-literal Unix paths with Path::join() in keys.rs and config.rs. These are only reached when ProjectDirs::from() returns None (rare), but the old form (PathBuf::from(".config/iroh-proxy/secret_key")) was sloppy on Windows.

// before
PathBuf::from(".config/iroh-proxy/config.toml")

// after
PathBuf::from(".config").join("iroh-proxy").join("config.toml")

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.