Security audit fixes: patch 16 vulnerabilities across 7 source files

CRITICAL:
- Instance name path traversal (AP-001): sanitize::sanitize_instance_name()
  strips .., /, \, \0, spaces, special chars at all 12 join call sites
- Zip-slip protection in world import: starts_with() guard after enclosed_name()

HIGH:
- RCON command injection: validate_username() rejects non-MC usernames
  across all 6 player action macros (whitelist, op, ban)
- Level-seed properties injection: sanitize_seed() strips \n \r = : \0
- CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie

MEDIUM:
- Session TTL: server-side 24h expiry via strftime check in require_auth
- Rate limiting: in-memory 10-ip/5min sliding window on login
- Background task stale is_active: all queries use concrete WHERE id=?1
- Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap

LOW:
- Logout auth guard: moved into protected route group + CurrentUser param
- Mod orphan race: DB insert before file write
- Backup orphan race: DB insert before ZIP creation
- Template fix: broken Askama == comparisons in edit.html

All fixes compile clean with zero warnings. 10 unit tests pass.

1 files changed, 15 insertions, 24 deletions

diff --git a/templates/instances/edit.html b/templates/instances/edit.html
index 2660461..77dfca6 100644
--- a/templates/instances/edit.html
+++ b/templates/instances/edit.html
@@ -35,8 +35,7 @@
           value="0"
           {%
           if
-          instance.difficulty=""
-          ="0"
+          instance.difficulty == 0
           %}selected{%
           endif
           %}
@@ -47,8 +46,7 @@
           value="1"
           {%
           if
-          instance.difficulty=""
-          ="1"
+          instance.difficulty == 1
           %}selected{%
           endif
           %}
@@ -59,8 +57,7 @@
           value="2"
           {%
           if
-          instance.difficulty=""
-          ="2"
+          instance.difficulty == 2
           %}selected{%
           endif
           %}
@@ -71,8 +68,7 @@
           value="3"
           {%
           if
-          instance.difficulty=""
-          ="3"
+          instance.difficulty == 3
           %}selected{%
           endif
           %}
@@ -84,16 +80,16 @@
     <label>
       Gamemode
       <select name="gamemode">
-        <option value="0" {% if instance.gamemode="" ="0" %}selected{% endif %}>
+        <option value="0" {% if instance.gamemode == 0 %}selected{% endif %}>
           Survival
         </option>
-        <option value="1" {% if instance.gamemode="" ="1" %}selected{% endif %}>
+        <option value="1" {% if instance.gamemode == 1 %}selected{% endif %}>
           Creative
         </option>
-        <option value="2" {% if instance.gamemode="" ="2" %}selected{% endif %}>
+        <option value="2" {% if instance.gamemode == 2 %}selected{% endif %}>
           Adventure
         </option>
-        <option value="3" {% if instance.gamemode="" ="3" %}selected{% endif %}>
+        <option value="3" {% if instance.gamemode == 3 %}selected{% endif %}>
           Spectator
         </option>
       </select>
@@ -162,8 +158,8 @@
   {% endif %}
 
   <div class="meta" style="margin-bottom: 1rem">
-    <span
-      ><strong>Current seed:</strong>
+    <span>
+      <strong>Current seed:</strong>
       {% if let Some(seed) = current_seed %} {{ seed }} {% else %}
       <em>not yet generated</em>
       {% endif %}
@@ -181,8 +177,7 @@
       {%
       if
       instance.is_active
-      %}
-      tabindex="-1"
+      %}tabindex="-1"
       {%
       endif
       %}
@@ -205,8 +200,7 @@
         {%
         if
         instance.is_active
-        %}
-        disabled{%
+        %}disabled{%
         endif
         %}
       />
@@ -219,8 +213,7 @@
         {%
         if
         instance.is_active
-        %}
-        disabled{%
+        %}disabled{%
         endif
         %}
       >
@@ -246,8 +239,7 @@
         {%
         if
         instance.is_active
-        %}
-        disabled{%
+        %}disabled{%
         endif
         %}
       />
@@ -257,8 +249,7 @@
         {%
         if
         instance.is_active
-        %}
-        disabled{%
+        %}disabled{%
         endif
         %}
       >