fix: deep bug hunt II — concurrency, security & optimization (25 files)

Critical: watchdog mutex panic safety, SetGeoAppOverride nil guard,
SSD-only app DB restore fallback.

High: double deploy race (atomic Deploying flag), delete/remove during
deploy guard, ScanStacks overwrite protection, FileBrowser mount mutex,
PushEvent history, PushOnce error handling, DB dump sync+close before
rename, restic retry fresh context, encrypt failure logging, cross-backup
path traversal validation, deepCopyStack completeness.

Security: constant-time API key comparison, login rate limiting (5/min),
git credential masking in logs, storage path prefix traversal fix.

Concurrency: MigrateEncryption lock ordering, SubdomainInUse I/O outside
lock, scheduler late-registered jobs, SQLite WAL verification, metrics
shutdown context, telemetry scan error logging, asset sync lock scope.

Optimization: streaming file copy for DB dumps, restic stats dedup,
atomic infra config copy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/web/handlers.go

@@ -965,6 +965,23 @@ func (s *Server) settingsCrossBackupHandler(w http.ResponseWriter, r *http.Reque
 		schedule = existing.Schedule
 	}
 
+	// Validate destination path against registered storage paths (H11 fix — matches API handler).
+	if enabled && destPath != "" {
+		registeredPaths := s.settings.GetStoragePaths()
+		validDest := false
+		for _, sp := range registeredPaths {
+			if destPath == sp.Path {
+				validDest = true
+				break
+			}
+		}
+		if !validDest {
+			s.logger.Printf("[WARN] Cross-drive backup: rejected invalid dest path %q for %s", destPath, name)
+			http.Redirect(w, r, "/stacks/"+name+"/deploy?flash_error="+url.QueryEscape("Érvénytelen célútvonal: "+destPath), http.StatusFound)
+			return
+		}
+	}
+
 	var cfg *settings.CrossDriveBackup
 	if destPath != "" || existing != nil {
 		cfg = &settings.CrossDriveBackup{
@@ -1543,6 +1560,10 @@ func (s *Server) settingsStorageLabelHandler(w http.ResponseWriter, r *http.Requ
 // SyncFileBrowserMounts regenerates FileBrowser's docker-compose.yml and config.yaml
 // with volume mounts and sources for all registered storage paths, then recreates the container.
 func (s *Server) SyncFileBrowserMounts() {
+	// Prevent concurrent syncs — multiple callers can race on the same files (H5 fix).
+	s.fileBrowserMu.Lock()
+	defer s.fileBrowserMu.Unlock()
+
 	stackDir := "/opt/docker/stacks/filebrowser"
 	composePath := stackDir + "/docker-compose.yml"