Security audit fixes: patch 16 vulnerabilities across 7 source files

CRITICAL:
- Instance name path traversal (AP-001): sanitize::sanitize_instance_name()
  strips .., /, \, \0, spaces, special chars at all 12 join call sites
- Zip-slip protection in world import: starts_with() guard after enclosed_name()

HIGH:
- RCON command injection: validate_username() rejects non-MC usernames
  across all 6 player action macros (whitelist, op, ban)
- Level-seed properties injection: sanitize_seed() strips \n \r = : \0
- CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie

MEDIUM:
- Session TTL: server-side 24h expiry via strftime check in require_auth
- Rate limiting: in-memory 10-ip/5min sliding window on login
- Background task stale is_active: all queries use concrete WHERE id=?1
- Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap

LOW:
- Logout auth guard: moved into protected route group + CurrentUser param
- Mod orphan race: DB insert before file write
- Backup orphan race: DB insert before ZIP creation
- Template fix: broken Askama == comparisons in edit.html

All fixes compile clean with zero warnings. 10 unit tests pass.

1 files changed, 282 insertions, 0 deletions

diff --git a/piolium/attack-surface/sbom.json b/piolium/attack-surface/sbom.json
new file mode 100644
index 0000000..3f7d7eb
--- /dev/null
+++ b/piolium/attack-surface/sbom.json
@@ -0,0 +1,282 @@
+{
+  "target": "salmon/minecraft-ui",
+  "generated_at": "2025-07-29T01:15:00Z",
+  "components": [
+    {
+      "name": "rust",
+      "category": "runtime",
+      "ecosystem": null,
+      "version": "edition 2024",
+      "relationship": "direct",
+      "purpose": "Language runtime for the application",
+      "evidence": ["Cargo.toml:3 edition = \"2024\""],
+      "security_relevant": false
+    },
+    {
+      "name": "axum",
+      "category": "framework",
+      "ecosystem": "crates.io",
+      "version": "0.8.9",
+      "relationship": "direct",
+      "purpose": "HTTP web framework (router, middleware, extractors)",
+      "evidence": ["Cargo.toml:7", "src/routes/mod.rs:3 use"],
+      "security_relevant": true
+    },
+    {
+      "name": "multer",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "3.1.0",
+      "relationship": "direct",
+      "purpose": "Multipart/form-data parser for file uploads",
+      "evidence": ["Cargo.toml:8", "src/routes/mods.rs:106 use multer::Multipart"],
+      "security_relevant": true
+    },
+    {
+      "name": "tokio",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "1.52.3",
+      "relationship": "direct",
+      "purpose": "Async runtime (TCP, timers, tasks)",
+      "evidence": ["Cargo.toml:9", "src/main.rs:15 #[tokio::main]"],
+      "security_relevant": true
+    },
+    {
+      "name": "rusqlite",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.40.1",
+      "relationship": "direct",
+      "purpose": "SQLite database interface",
+      "evidence": ["Cargo.toml:11", "src/db.rs:2 use"],
+      "security_relevant": true
+    },
+    {
+      "name": "bollard",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.17.1",
+      "relationship": "direct",
+      "purpose": "Docker Engine API client",
+      "evidence": ["Cargo.toml:12", "src/docker.rs:2-8 use bollard::*"],
+      "security_relevant": true
+    },
+    {
+      "name": "argon2",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.5.3",
+      "relationship": "direct",
+      "purpose": "Password hashing (Argon2id algorithm)",
+      "evidence": ["Cargo.toml:17", "src/auth.rs:1-2 use argon2::*"],
+      "security_relevant": true
+    },
+    {
+      "name": "zip",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "8.6.0",
+      "relationship": "direct",
+      "purpose": "ZIP archive reading/writing (world export/import, mods, backups)",
+      "evidence": ["Cargo.toml:20", "src/mods.rs:8 use zip::ZipArchive"],
+      "security_relevant": true
+    },
+    {
+      "name": "reqwest",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.13.4",
+      "relationship": "direct",
+      "purpose": "HTTP client for Mojang version manifest API",
+      "evidence": ["Cargo.toml:26", "src/routes/instances.rs:280"],
+      "security_relevant": false
+    },
+    {
+      "name": "cookie",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.18.1",
+      "relationship": "direct",
+      "purpose": "Cookie parsing utilities",
+      "evidence": ["Cargo.toml:28"],
+      "security_relevant": true
+    },
+    {
+      "name": "axum-extra",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.12.6",
+      "relationship": "direct",
+      "purpose": "Extra axum utilities including cookie private jar",
+      "evidence": ["Cargo.toml:29", "features = [\"cookie-private\"]"],
+      "security_relevant": true
+    },
+    {
+      "name": "serde",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "1.0.228",
+      "relationship": "direct",
+      "purpose": "Serialization/deserialization framework",
+      "evidence": ["Cargo.toml:13"],
+      "security_relevant": false
+    },
+    {
+      "name": "askama",
+      "category": "framework",
+      "ecosystem": "crates.io",
+      "version": "0.16.0",
+      "relationship": "direct",
+      "purpose": "Compile-time template engine",
+      "evidence": ["Cargo.toml:10", "src/routes/*.rs: use askama::Template"],
+      "security_relevant": false
+    },
+    {
+      "name": "tower-http",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.7.0",
+      "relationship": "direct",
+      "purpose": "HTTP middleware (static file serving via ServeDir)",
+      "evidence": ["Cargo.toml:15", "src/routes/mod.rs:6"],
+      "security_relevant": false
+    },
+    {
+      "name": "chrono",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.4.45",
+      "relationship": "direct",
+      "purpose": "Date/time handling for backup timestamps",
+      "evidence": ["Cargo.toml:27", "src/routes/backups.rs:69"],
+      "security_relevant": false
+    },
+    {
+      "name": "uuid",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "1.23.4",
+      "relationship": "direct",
+      "purpose": "UUID generation for session IDs",
+      "evidence": ["Cargo.toml:18", "src/auth.rs:82"],
+      "security_relevant": false
+    },
+    {
+      "name": "tempfile",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "3.27.0",
+      "relationship": "direct",
+      "purpose": "Temporary file/directory management",
+      "evidence": ["Cargo.toml:21"],
+      "security_relevant": false
+    },
+    {
+      "name": "rand",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.8.7",
+      "relationship": "direct",
+      "purpose": "Random number generation for RCON passwords",
+      "evidence": ["Cargo.toml:19", "src/routes/instances.rs:263"],
+      "security_relevant": true
+    },
+    {
+      "name": "tracing",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.1.44",
+      "relationship": "direct",
+      "purpose": "Logging and instrumentation framework",
+      "evidence": ["Cargo.toml:22", "src/main.rs:3 use tracing_subscriber"],
+      "security_relevant": false
+    },
+    {
+      "name": "serde_json",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "1.0.150",
+      "relationship": "direct",
+      "purpose": "JSON parsing (Fabric mod metadata, Mojang API)",
+      "evidence": ["Cargo.toml:14", "src/mods.rs: parse_fabric_metadata"],
+      "security_relevant": false
+    },
+    {
+      "name": "toml",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "1.1.2+spec-1.1.0",
+      "relationship": "direct",
+      "purpose": "TOML config parsing + Forge mod metadata parsing",
+      "evidence": ["Cargo.toml:16", "src/config.rs:9", "src/mods.rs: parse_forge_metadata"],
+      "security_relevant": false
+    },
+    {
+      "name": "futures-util",
+      "category": "package",
+      "ecosystem": "crates.io",
+      "version": "0.3.32",
+      "relationship": "direct",
+      "purpose": "Async stream utilities for Docker image pull",
+      "evidence": ["Cargo.toml:30", "src/docker.rs:6 use futures_util::StreamExt"],
+      "security_relevant": false
+    },
+    {
+      "name": "Docker daemon",
+      "category": "binary",
+      "ecosystem": null,
+      "version": "unknown (local)",
+      "relationship": "direct",
+      "purpose": "Container runtime for Minecraft server instances",
+      "evidence": ["src/docker.rs:28 Docker::connect_with_local_defaults()"],
+      "security_relevant": true
+    },
+    {
+      "name": "itzg/minecraft-server",
+      "category": "container-os",
+      "ecosystem": "docker",
+      "version": "java8 / java17 / java21 (dynamic per version)",
+      "relationship": "direct",
+      "purpose": "Minecraft server Docker image (Java + Minecraft server jar)",
+      "evidence": ["src/docker.rs:34-43 java_tag()", "minecraft/docker-compose.yml"],
+      "security_relevant": true
+    },
+    {
+      "name": "piston-meta.mojang.com",
+      "category": "external-service",
+      "ecosystem": null,
+      "version": "N/A (API)",
+      "relationship": "direct",
+      "purpose": "Minecraft version manifest API",
+      "evidence": ["src/routes/instances.rs:280"],
+      "security_relevant": false
+    },
+    {
+      "name": "htmx.min.js",
+      "category": "vendored",
+      "ecosystem": null,
+      "version": "unknown (vendored)",
+      "relationship": "direct",
+      "purpose": "HTMX JavaScript library for dynamic HTML",
+      "evidence": ["static/htmx.min.js"],
+      "security_relevant": false
+    },
+    {
+      "name": "SQLite",
+      "category": "datastore",
+      "ecosystem": null,
+      "version": "bundled (via rusqlite bundled feature)",
+      "relationship": "direct",
+      "purpose": "Embedded database for accounts, sessions, instances, mods, backups",
+      "evidence": ["Cargo.toml:11 features = [\"bundled\"]", "src/db.rs"],
+      "security_relevant": true
+    }
+  ],
+  "categories_covered": ["runtime", "package", "framework", "datastore", "external-service", "container-os", "binary", "vendored"],
+  "coverage_gaps": [
+    "build-ci: No CI configuration found in repository",
+    "container-os: Dockerfile not in repo — base image pulled externally (itzg/minecraft-server)",
+    "binary: Java runtime version is dynamic per Minecraft version, not pinned"
+  ]
+}