POST /shorten (x-api-key) { url, slug?, allowUTM?, auto?: 'hash6'|'seq'|'semantic'|true, desktopUrl?, mobileUrl?, iosUrl?, androidUrl?, preset? }
GET  /shorten?url=...&mode=hash6|seq|semantic|random&desktopUrl=...&mobileUrl=...&iosUrl=...&androidUrl=... (x-api-key)
GET  /:slug[@tpl][+preset][~inline][/:p1/:p2/:p3]
GET  /stats/:slug?start=YYYY-MM-DD&end=YYYY-MM-DD&groupBy=variant=1
POST /template (x-api-key) { name, host?, target?, utm?, addParams?, map?, lock?, trackKeys?, allowUTM? }
GET  /template/{name} | /templates | DELETE /template/{name} (x-api-key)
POST /preset (x-api-key) { tag, defaultParams?, paramAliases?, valueAliases?, paramDevices?, utm? }
GET  /preset/{tag} | /presets | DELETE /preset/{tag} (x-api-key)
ENV: SHORTENER_API_KEY, ALLOWED_HOSTS (csv), FORBIDDEN_HOSTS (csv) — se ALLOWED_HOSTS vazio, permite todos (exceto FORBIDDEN_HOSTS).