v0.12.3 — Security & correctness bug fixes (33 bugs)

CRITICAL: 10 data race and security fixes — backup.go mutex coverage
(C1-C4), IsSystemDisk 12-bit major/minor (C5), /dev/ path validation
(C6), extractName traversal (C7), TargetPath/DestinationPath against
registered paths (C8-C9), ParseComposeHDDMounts Clean-before-prefix (C10).

HIGH: 17 logic/resource fixes — ValidateDump bufio.Scanner (H1), single
appDirSize() with 30s timeout (H2/H3), snapshot ID regex (H4), cross-drive
restic prune (H5), temp file order (H6), dirSizeBytes errors (H7), atomic
fstab (H8), IsDeviceMounted suffix check (H9), eMMC partition mapping (H10),
bytesCopied mutex (H11), separator-aware migrate prefix (H13), DeleteStack
error on compose-down (H14), docker 60s timeout (H16), NotificationPrefs
deep-copy (H17), wipefs warning (H18), fstab rollback on mount fail (H19).

MEDIUM: 7 code quality fixes — formatBytes dedup (M1), .tmp filter order
(M2), sizeBytes string type (M3), elapsed in message (M6), LoadLocation
fallback (M7), pathCovers separator (M10), cancelEditLabel textContent (M11).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

controller/internal/stacks/delete.go

@@ -84,11 +84,12 @@ func (m *Manager) DeleteStack(name string, removeHDDData bool) (*DeleteResponse,
 	hddMounts := ParseComposeHDDMounts(stack.ComposePath, hddPath)
 
 	// Step 2: Run docker compose down --rmi local --volumes
+	// H14: Return error if docker compose down fails — continuing would leave orphaned containers.
 	env := m.stackEnv(stackDir)
 	output, err := m.composeExecCustomEnv(stackDir, env, "down", "--rmi", "local", "--volumes")
 	if err != nil {
-		m.logger.Printf("[WARN] docker compose down for %s had errors: %v (output: %s)", name, err, truncateStr(output, 200))
-		// Continue anyway — the stack dir will be removed
+		m.logger.Printf("[ERROR] docker compose down for %s failed: %v (output: %s)", name, err, truncateStr(output, 200))
+		return resp, fmt.Errorf("docker compose down failed for %s: %w", name, err)
 	}
 
 	// Step 3: Identify removed volumes from compose output
@@ -244,12 +245,14 @@ func ParseComposeHDDMounts(composePath, hddPath string) []string {
 		// Resolve ${HDD_PATH} variable reference
 		hostPath = strings.ReplaceAll(hostPath, "${HDD_PATH}", hddPath)
 
-		// Check if this is an HDD mount
-		if !strings.HasPrefix(hostPath, hddPath) {
+		// C10: Clean path BEFORE prefix check to prevent traversal like ${HDD_PATH}/../../etc/passwd.
+		cleanPath := filepath.Clean(hostPath)
+		cleanHDD := filepath.Clean(hddPath)
+
+		// Check if this is an HDD mount (must be cleanHDD itself or a direct subpath)
+		if cleanPath != cleanHDD && !strings.HasPrefix(cleanPath, cleanHDD+string(filepath.Separator)) {
 			continue
 		}
-
-		cleanPath := filepath.Clean(hostPath)
 		if !seen[cleanPath] {
 			seen[cleanPath] = true
 			mounts = append(mounts, cleanPath)