fix: deep bug hunt II — concurrency, security & optimization (25 files)

Critical: watchdog mutex panic safety, SetGeoAppOverride nil guard,
SSD-only app DB restore fallback.

High: double deploy race (atomic Deploying flag), delete/remove during
deploy guard, ScanStacks overwrite protection, FileBrowser mount mutex,
PushEvent history, PushOnce error handling, DB dump sync+close before
rename, restic retry fresh context, encrypt failure logging, cross-backup
path traversal validation, deepCopyStack completeness.

Security: constant-time API key comparison, login rate limiting (5/min),
git credential masking in logs, storage path prefix traversal fix.

Concurrency: MigrateEncryption lock ordering, SubdomainInUse I/O outside
lock, scheduler late-registered jobs, SQLite WAL verification, metrics
shutdown context, telemetry scan error logging, asset sync lock scope.

Optimization: streaming file copy for DB dumps, restic stats dedup,
atomic infra config copy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/cmd/controller/main.go

@@ -14,6 +14,7 @@ import (
 	"syscall"
 	"time"
 
+	"crypto/subtle"
 	"strings"
 
 	"gitea.dooplex.hu/admin/felhom-controller/internal/api"
@@ -688,7 +689,8 @@ func main() {
 		}
 		dc.HubConnectivityTest = func() (int, int64, error) {
 			start := time.Now()
-			resp, err := http.Get(cfg.Hub.URL + "/healthz")
+			client := &http.Client{Timeout: 10 * time.Second}
+			resp, err := client.Get(cfg.Hub.URL + "/healthz")
 			latency := time.Since(start).Milliseconds()
 			if err != nil {
 				return 0, latency, err
@@ -817,7 +819,7 @@ func selfUpdateAuthMiddleware(cfg *config.Config, webServer *web.Server, next ht
 		// Check bearer token first (for external API calls: hub, build scripts)
 		if auth := r.Header.Get("Authorization"); strings.HasPrefix(auth, "Bearer ") {
 			token := strings.TrimPrefix(auth, "Bearer ")
-			if token != "" && cfg.Hub.APIKey != "" && token == cfg.Hub.APIKey {
+			if token != "" && cfg.Hub.APIKey != "" && subtle.ConstantTimeCompare([]byte(token), []byte(cfg.Hub.APIKey)) == 1 {
 				next.ServeHTTP(w, r)
 				return
 			}