v0.6.1: Code review bugfixes — 7 correctness/safety/quality fixes

- Fix http.NotFound(w, nil) → pass actual request in handlers
- Fix dashboard running/stopped counts to match displayed stacks
- Fix Secure cookie blocking HTTP login (dynamic based on request)
- Remove misleading subtle.ConstantTimeCompare in session check
- Fix cleanupSessions goroutine leak (proper ticker + done channel)
- Add http.MaxBytesReader (1MB) to API POST endpoints
- Cache time.LoadLocation("Europe/Budapest") in template funcmap

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/web/handlers.go

@@ -22,21 +22,7 @@ func (s *Server) baseData(page, title string) map[string]interface{} {
 func (s *Server) dashboardHandler(w http.ResponseWriter, _ *http.Request) {
 	stackList := s.stackMgr.GetStacks()
 
-	running, stopped := 0, 0
-	for _, st := range stackList {
-		switch st.State {
-		case stacks.StateRunning:
-			running++
-		case stacks.StateStopped, stacks.StateExited:
-			stopped++
-		case stacks.StateStarting, stacks.StateUnhealthy, stacks.StateRestarting:
-			// Count starting/unhealthy/restarting as "running" for the dashboard stat
-			// (they have containers, they're just not fully healthy yet)
-			running++
-		}
-	}
-
-	// Filter to deployed + protected stacks only for dashboard display
+	// Filter to deployed + protected stacks first
 	var deployedStacks []stacks.Stack
 	for _, st := range stackList {
 		if st.Deployed || st.Protected {
@@ -44,6 +30,17 @@ func (s *Server) dashboardHandler(w http.ResponseWriter, _ *http.Request) {
 		}
 	}
 
+	// Count from the DISPLAYED set only
+	running, stopped := 0, 0
+	for _, st := range deployedStacks {
+		switch st.State {
+		case stacks.StateRunning, stacks.StateStarting, stacks.StateUnhealthy, stacks.StateRestarting:
+			running++
+		case stacks.StateStopped, stacks.StateExited:
+			stopped++
+		}
+	}
+
 	sysInfo := system.GetInfo(s.cfg.Paths.HDDPath, s.cpuCollector)
 
 	data := s.baseData("dashboard", "Vezérlőpult")
@@ -99,10 +96,10 @@ func (s *Server) logsHandler(w http.ResponseWriter, r *http.Request, name string
 	s.render(w, "logs", data)
 }
 
-func (s *Server) deployHandler(w http.ResponseWriter, _ *http.Request, name string) {
+func (s *Server) deployHandler(w http.ResponseWriter, r *http.Request, name string) {
 	meta, appCfg, err := s.stackMgr.GetDeployFields(name)
 	if err != nil {
-		http.NotFound(w, nil)
+		http.NotFound(w, r)
 		return
 	}
 
@@ -160,7 +157,7 @@ func (s *Server) deployHandler(w http.ResponseWriter, _ *http.Request, name stri
 	s.render(w, "deploy", data)
 }
 
-func (s *Server) appDetailHandler(w http.ResponseWriter, _ *http.Request, slug string) {
+func (s *Server) appDetailHandler(w http.ResponseWriter, r *http.Request, slug string) {
 	var found *stacks.Stack
 	for _, stack := range s.stackMgr.GetStacks() {
 		if stack.Meta.Slug == slug {
@@ -169,7 +166,7 @@ func (s *Server) appDetailHandler(w http.ResponseWriter, _ *http.Request, slug s
 		}
 	}
 	if found == nil {
-		http.NotFound(w, nil)
+		http.NotFound(w, r)
 		return
 	}