v0.12.3 — Security & correctness bug fixes (33 bugs)

CRITICAL: 10 data race and security fixes — backup.go mutex coverage
(C1-C4), IsSystemDisk 12-bit major/minor (C5), /dev/ path validation
(C6), extractName traversal (C7), TargetPath/DestinationPath against
registered paths (C8-C9), ParseComposeHDDMounts Clean-before-prefix (C10).

HIGH: 17 logic/resource fixes — ValidateDump bufio.Scanner (H1), single
appDirSize() with 30s timeout (H2/H3), snapshot ID regex (H4), cross-drive
restic prune (H5), temp file order (H6), dirSizeBytes errors (H7), atomic
fstab (H8), IsDeviceMounted suffix check (H9), eMMC partition mapping (H10),
bytesCopied mutex (H11), separator-aware migrate prefix (H13), DeleteStack
error on compose-down (H14), docker 60s timeout (H16), NotificationPrefs
deep-copy (H17), wipefs warning (H18), fstab rollback on mount fail (H19).

MEDIUM: 7 code quality fixes — formatBytes dedup (M1), .tmp filter order
(M2), sizeBytes string type (M3), elapsed in message (M6), LoadLocation
fallback (M7), pathCovers separator (M10), cancelEditLabel textContent (M11).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

controller/internal/backup/restore.go

@@ -1,6 +1,12 @@
 package backup
 
-import "fmt"
+import (
+	"fmt"
+	"regexp"
+)
+
+// snapshotIDRe validates restic snapshot IDs: 8-64 lowercase hex characters.
+var snapshotIDRe = regexp.MustCompile(`^[0-9a-f]{8,64}$`)
 
 // RestoreApp restores an app's HDD data from a restic snapshot.
 func (m *Manager) RestoreApp(stackName, snapshotID string) error {
@@ -18,20 +24,10 @@ func (m *Manager) RestoreApp(stackName, snapshotID string) error {
 		return fmt.Errorf("no HDD data paths found for %s", stackName)
 	}
 
-	// Validate snapshot exists
-	snapshots, err := m.restic.ListSnapshots(100)
-	if err != nil {
-		return fmt.Errorf("listing snapshots: %w", err)
-	}
-	found := false
-	for _, s := range snapshots {
-		if s.ID == snapshotID {
-			found = true
-			break
-		}
-	}
-	if !found {
-		return fmt.Errorf("snapshot %s not found", snapshotID)
+	// H4: Validate snapshot ID format by regex instead of listing all snapshots (list caps at 100).
+	// restic restore will return a clear error if the snapshot ID doesn't exist.
+	if !snapshotIDRe.MatchString(snapshotID) {
+		return fmt.Errorf("invalid snapshot ID: must be 8-64 lowercase hex characters")
 	}
 
 	// Use the running flag to prevent concurrent backup/restore