POST /shorten (x-api-key) { url, slug?, allowUTM?, auto?: 'hash6'|'seq'|'semantic'|true }
GET  /shorten?url=...&mode=hash6|seq|semantic|random (x-api-key)
GET  /:slug[@tpl][+preset][~inline]
GET  /stats/:slug?start=YYYY-MM-DD&end=YYYY-MM-DD&groupBy=variant=1
POST /template (x-api-key) { name, host?, target?, utm?, addParams?, map?, lock?, trackKeys?, allowUTM? }
GET  /template/{name} | /templates | DELETE /template/{name} (x-api-key)
POST /preset (x-api-key) { tag, utm:{...} }
GET  /preset/{tag} | DELETE /preset/{tag} (x-api-key)
ENV: ALLOWED_HOSTS (csv), FORBIDDEN_HOSTS (csv) — se ALLOWED_HOSTS vazio, permite todos (exceto FORBIDDEN_HOSTS).