fix: P2+P3 bug fixes, hardening, and cleanup (18 files)

Bug fixes:
- Add applyEnvOverrides to LoadFromBytes (M05)
- Set state=failed on compose-up failure in selfupdate (M16)
- Clamp usableMB to min 0 in memory check (M22)
- Remove "manual" schedule from triggerAllCrossBackups (M23)
- Add mmcblk device handling for partition paths (M21)
- Fix stripPartition for mmcblk devices (L25)
- Fix TruncateStr for UTF-8 and negative maxLen (L05/L06)
- Fix AllDone to return false for empty restore plans (L14)
- Fix PushOnce to return actual errors (L39)
- Restore pending events on save failure in DrainPendingEvents (M03)
- Add duplicate check in AddStoragePath (M04)
- Call CleanupTempMounts after drive scan (H13)
- Log SetStep save errors (M25)

Hardening:
- Guard scheduler Start() against double-start (M14)
- Acquire mutex in scheduler Stop() before reading cancel (L24)
- Cap log lines parameter to 10000 (L31)
- Require POST for logout (L32)
- Use sync.Once for Server.Close() (L49)
- Panic on crypto/rand.Read failure in setup CSRF (L40)
- Validate Bearer token against Hub API key in CSRF (H16 fix)
- Replace custom hasPrefix with strings.HasPrefix (L13)
- Replace simpleHash with crc32.ChecksumIEEE (L48)

Cleanup:
- Remove dead imageName function (L02)
- Remove dead detectHostIPViaRoute function (L03)
- Rename shadowed copy variable to cp (L07)
- Copy DefaultEnabledEvents in GetNotificationPrefs early return (L09)
- Update BUGHUNT.md with comprehensive audit results

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/scheduler/scheduler.go

@@ -95,12 +95,15 @@ func (s *Scheduler) Daily(name string, timeStr string, fn JobFunc) {
 	s.logger.Printf("[SCHED] Daily job %s scheduled for %s", name, nextRun.Format("2006-01-02 15:04 MST"))
 }
 
-// Start begins running all registered jobs.
+// Start begins running all registered jobs. Safe to call only once.
 func (s *Scheduler) Start(ctx context.Context) {
-	s.ctx, s.cancel = context.WithCancel(ctx)
-
 	s.mu.Lock()
-	defer s.mu.Unlock()
+	if s.cancel != nil {
+		s.mu.Unlock()
+		s.logger.Println("[WARN] Scheduler already started — ignoring duplicate Start()")
+		return
+	}
+	s.ctx, s.cancel = context.WithCancel(ctx)
 
 	for _, job := range s.jobs {
 		if job.Interval > 0 {
@@ -113,12 +116,16 @@ func (s *Scheduler) Start(ctx context.Context) {
 	}
 
 	s.logger.Printf("[SCHED] Scheduler started with %d jobs", len(s.jobs))
+	s.mu.Unlock()
 }
 
 // Stop cancels all jobs and waits for them to finish (30s timeout).
 func (s *Scheduler) Stop() {
-	if s.cancel != nil {
-		s.cancel()
+	s.mu.Lock()
+	cancel := s.cancel
+	s.mu.Unlock()
+	if cancel != nil {
+		cancel()
 	}
 
 	done := make(chan struct{})