feat: allow loading mods without a Steam API key

Add fetchModFromUrl/fetchModFileFromUrl and accept a fileUrl query param on /items routes so the frontend can download saves directly from a search result's file_url, with no key required.

README.md

@@ -61,8 +61,12 @@ parser is the first place to look.
 
 ## Notes
 
-- `STEAM_API_KEY` is only needed for `/items/*` (resolving `file_url`). Search
-  works without it.
+- `STEAM_API_KEY` is optional. Search works without it. The mod page works
+  without it too when you arrive from a search result: the frontend passes the
+  item's `file_url` (already present in search results) to `/items/:id` via a
+  `fileUrl` query param, so the proxy downloads the save directly instead of
+  calling the Steam API. Without a key *and* without a `fileUrl` (e.g. a
+  deep-linked mod page), `/items/*` returns 500.
 - Each request fetches fresh; there is no caching by design (client-only tool).
 - `packages/extract` has zero runtime dependencies and runs in browser or Node,
   ready for a future frontend.