v0.6.1: Code review bugfixes — 7 correctness/safety/quality fixes

- Fix http.NotFound(w, nil) → pass actual request in handlers
- Fix dashboard running/stopped counts to match displayed stacks
- Fix Secure cookie blocking HTTP login (dynamic based on request)
- Remove misleading subtle.ConstantTimeCompare in session check
- Fix cleanupSessions goroutine leak (proper ticker + done channel)
- Add http.MaxBytesReader (1MB) to API POST endpoints
- Cache time.LoadLocation("Europe/Budapest") in template funcmap

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/web/server.go

@@ -29,6 +29,7 @@ type Server struct {
 
 	sessions   map[string]*session
 	sessionsMu sync.RWMutex
+	done       chan struct{}
 }
 
 func NewServer(cfg *config.Config, stackMgr *stacks.Manager, cpuCollector *system.CPUCollector, backupMgr *backup.Manager, sched *scheduler.Scheduler, logger *log.Logger, version string) *Server {
@@ -41,6 +42,7 @@ func NewServer(cfg *config.Config, stackMgr *stacks.Manager, cpuCollector *syste
 		logger:       logger,
 		version:      version,
 		sessions:     make(map[string]*session),
+		done:         make(chan struct{}),
 	}
 	s.loadTemplates()
 	go s.cleanupSessions()