Security audit fixes: patch 16 vulnerabilities across 7 source files

CRITICAL:
- Instance name path traversal (AP-001): sanitize::sanitize_instance_name()
  strips .., /, \, \0, spaces, special chars at all 12 join call sites
- Zip-slip protection in world import: starts_with() guard after enclosed_name()

HIGH:
- RCON command injection: validate_username() rejects non-MC usernames
  across all 6 player action macros (whitelist, op, ban)
- Level-seed properties injection: sanitize_seed() strips \n \r = : \0
- CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie

MEDIUM:
- Session TTL: server-side 24h expiry via strftime check in require_auth
- Rate limiting: in-memory 10-ip/5min sliding window on login
- Background task stale is_active: all queries use concrete WHERE id=?1
- Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap

LOW:
- Logout auth guard: moved into protected route group + CurrentUser param
- Mod orphan race: DB insert before file write
- Backup orphan race: DB insert before ZIP creation
- Template fix: broken Askama == comparisons in edit.html

All fixes compile clean with zero warnings. 10 unit tests pass.

1 files changed, 26 insertions, 0 deletions

diff --git a/piolium/attack-surface/candidates.jsonl b/piolium/attack-surface/candidates.jsonl
new file mode 100644
index 0000000..197a62f
--- /dev/null
+++ b/piolium/attack-surface/candidates.jsonl
@@ -0,0 +1,26 @@
+{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"eval","score":90,"source":"builtin"}
+{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
+{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
+{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
+{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
+{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
+{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"ruby eval","score":90,"source":"builtin"}
+{"slug":"command-execution","description":"Potential command execution or shell invocation with variable input.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"node child_process","score":80,"source":"builtin"}
+{"slug":"command-execution","description":"Potential command execution or shell invocation with variable input.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"node child_process","score":80,"source":"builtin"}
+{"slug":"command-execution","description":"Potential command execution or shell invocation with variable input.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"node child_process","score":80,"source":"builtin"}
+{"slug":"command-execution","description":"Potential command execution or shell invocation with variable input.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"node child_process","score":80,"source":"builtin"}
+{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"function constructor","score":80,"source":"builtin"}
+{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
+{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
+{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
+{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
+{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
+{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python file open","score":55,"source":"builtin"}
+{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python file open","score":55,"source":"builtin"}
+{"slug":"unsafe-html-or-template","description":"HTML injection sink or template escape bypass.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"dangerous html","score":55,"source":"builtin"}
+{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"request header read","score":55,"source":"builtin"}
+{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}
+{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}
+{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}
+{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}
+{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}