fix: deep bug hunt II — concurrency, security & optimization (25 files)

Critical: watchdog mutex panic safety, SetGeoAppOverride nil guard,
SSD-only app DB restore fallback.

High: double deploy race (atomic Deploying flag), delete/remove during
deploy guard, ScanStacks overwrite protection, FileBrowser mount mutex,
PushEvent history, PushOnce error handling, DB dump sync+close before
rename, restic retry fresh context, encrypt failure logging, cross-backup
path traversal validation, deepCopyStack completeness.

Security: constant-time API key comparison, login rate limiting (5/min),
git credential masking in logs, storage path prefix traversal fix.

Concurrency: MigrateEncryption lock ordering, SubdomainInUse I/O outside
lock, scheduler late-registered jobs, SQLite WAL verification, metrics
shutdown context, telemetry scan error logging, asset sync lock scope.

Optimization: streaming file copy for DB dumps, restic stats dedup,
atomic infra config copy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/web/server.go

@@ -41,10 +41,12 @@ type Server struct {
 	encKey           []byte // AES-256 key for decrypting app.yaml values
 	tmpl             *template.Template
 
-	sessions   map[string]*session
-	sessionsMu sync.RWMutex
-	done       chan struct{}
-	closeOnce  sync.Once
+	sessions       map[string]*session
+	sessionsMu     sync.RWMutex
+	loginAttempts  map[string]*loginAttempt
+	loginAttemptMu sync.Mutex
+	done           chan struct{}
+	closeOnce      sync.Once
 
 	// Disk operation state (format/migrate jobs)
 	diskJobMu sync.Mutex
@@ -53,6 +55,9 @@ type Server struct {
 	// Active raw mount for the attach wizard (empty when not in use)
 	activeRawMount string
 
+	// Guard for FileBrowser sync — prevents concurrent file writes (H5 fix)
+	fileBrowserMu sync.Mutex
+
 	// Drive migration
 	driveMigrator *storage.DriveMigrator
 
@@ -90,6 +95,7 @@ func NewServer(cfg *config.Config, stackMgr *stacks.Manager, cpuCollector *syste
 		logger:           logger,
 		version:          version,
 		sessions:         make(map[string]*session),
+		loginAttempts:    make(map[string]*loginAttempt),
 		done:             make(chan struct{}),
 	}
 	s.loadTemplates()
@@ -111,6 +117,7 @@ func NewServer(cfg *config.Config, stackMgr *stacks.Manager, cpuCollector *syste
 }
 
 // SetEncryptionKey sets the AES-256 key used to decrypt app.yaml values for display.
+// Must be called before ListenAndServe (all Set* methods are init-time only).
 func (s *Server) SetEncryptionKey(key []byte) {
 	s.encKey = key
 }