Security: Move OpenAI API call to server-side proxy

[JiwaniZakir]

Problem

src/Chatbot.jsx constructs the OpenAI client with dangerouslyAllowBrowser: true, which exposes the API key in the browser JavaScript bundle. Any user who opens DevTools can extract the key.

Proposed Solution

• Add a Vercel serverless function at api/chat.js that makes the OpenAI call server-side
• Move VITE_API_KEY to a non-prefixed OPENAI_API_KEY server env var
• Update the frontend to call the /api/chat endpoint instead of OpenAI directly
• Remove dangerouslyAllowBrowser: true flag