feat: browser access (allowed_origins, CORS with Private Network Access), job cancel, Tomie/Unity adapters, benchmark

Includes earlier uncommitted work: Tomie and Unity adapters, benchmark, structured output, call metrics.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

config.example.toml

@@ -1,6 +1,10 @@
 # Copy to config.toml. Relative paths are resolved from this file's directory.
 database = "data/translations.sqlite3"
 port = 8787
+# Sites allowed to call this API from the browser (the games library page).
+# Exact origins only, no wildcard. Restart after changing.
+allowed_origins = []
+# allowed_origins = ["https://games.example", "http://localhost:5173"]
 
 [providers.lmstudio]
 base_url = "http://127.0.0.1:1234/v1"
@@ -9,6 +13,7 @@ model = ""
 api_key_env = "LM_STUDIO_API_KEY"
 timeout = 180
 prompt_style = "hy_mt"
+structured_output = true
 # Tencent's recommended sampling parameters for HY-MT2-7B.
 temperature = 0.7
 top_p = 0.6