Proxy random media with the token in the query, and bootstrap before listening !28

Two small fixes found during the art.krz.sh incident.

• /api/random returned 401 with proxying on. sendMedia sliced the wixmp URL by fixed offsets and passed .../file.png?token=... as the path, so the token was percent-encoded into the path and wixmp rejected it. It now parses the URL and calls the media proxy with subdomain, path and token separately, the same way the media route does. Download sits behind a fetchMedia seam for the test.
• The first CSRF bootstrap now runs before the listener opens. Requests in the first seconds after a restart used to go upstream without a session and 502.

Ref #1 (the duplicated URL slicing).