Covers the missing-key 503, hasKey reporting, input validation without an
upstream call, the hazy-to-decisive override, upstream failures preserving
status plus fallback, and deterministic offline fallbacks.
Also points "main" at server.js, since index.js did not exist.