v0.12.4 — 15 bug fixes (CRITICAL/HIGH/MEDIUM)

CRITICAL:
- C1: SetAppBackupBulk data loss + nil map panic (settings.go)
- C2: UpdateStackConfig nil Env map panic (deploy.go)
- C3: ValidateDump missing scanner.Err() check (dbdump.go)

HIGH:
- H1: nextDailyRun DST bug — use time.Date(day+1) not Add(24h)
- H2: Cache Europe/Budapest timezone with sync.Once in scheduler
- H3: settings.save() leaks .tmp file on WriteFile failure
- H4: SetNotificationPrefs nil pointer panic
- H5: appDirSize + getDirSizeBytes ignore Sscanf return value
- H6: getDirSizeBytes has no timeout — add 30s context
- H7: dbdump.go tmpFile not using defer Close
- H8: UpdateCrossDriveStatus misleading comment

MEDIUM:
- M1: Replace custom containsBytes with strings.Contains
- M2: scheduler.Every() validates interval > 0
- M3: executeJob panic recovery now sets LastRun
- M4: logPostStartStatus copies env slice before goroutine
- M5: Cache timezone in web package via getTimezone() sync.Once

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

controller/internal/stacks/delete.go

@@ -2,6 +2,7 @@ package stacks
 
 import (
 	"bufio"
+	"context"
 	"fmt"
 	"os"
 	"os/exec"
@@ -278,7 +279,9 @@ func getDirSizeHuman(path string) string {
 
 // getDirSizeBytes returns the total size in bytes for a directory.
 func getDirSizeBytes(path string) int64 {
-	cmd := exec.Command("du", "-sb", path)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "du", "-sb", path)
 	output, err := cmd.Output()
 	if err != nil {
 		return 0
@@ -286,7 +289,9 @@ func getDirSizeBytes(path string) int64 {
 	fields := strings.Fields(string(output))
 	if len(fields) > 0 {
 		var size int64
-		fmt.Sscanf(fields[0], "%d", &size)
+		if n, _ := fmt.Sscanf(fields[0], "%d", &size); n != 1 {
+			return 0
+		}
 		return size
 	}
 	return 0