fix: deep bug hunt II — concurrency, security & optimization (25 files)

Critical: watchdog mutex panic safety, SetGeoAppOverride nil guard,
SSD-only app DB restore fallback.

High: double deploy race (atomic Deploying flag), delete/remove during
deploy guard, ScanStacks overwrite protection, FileBrowser mount mutex,
PushEvent history, PushOnce error handling, DB dump sync+close before
rename, restic retry fresh context, encrypt failure logging, cross-backup
path traversal validation, deepCopyStack completeness.

Security: constant-time API key comparison, login rate limiting (5/min),
git credential masking in logs, storage path prefix traversal fix.

Concurrency: MigrateEncryption lock ordering, SubdomainInUse I/O outside
lock, scheduler late-registered jobs, SQLite WAL verification, metrics
shutdown context, telemetry scan error logging, asset sync lock scope.

Optimization: streaming file copy for DB dumps, restic stats dedup,
atomic infra config copy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/stacks/delete.go

@@ -86,6 +86,11 @@ func (m *Manager) DeleteStack(name string, removeHDDData bool) (*DeleteResponse,
 		return nil, fmt.Errorf("stack %q is not orphaned — only orphaned stacks can be deleted", name)
 	}
 
+	// Must not be deploying (H2 fix)
+	if stack.Deploying {
+		return nil, fmt.Errorf("stack %q is currently being deployed — wait for deployment to finish", name)
+	}
+
 	// Must be stopped (not running)
 	if stack.State == StateRunning || stack.State == StateStarting || stack.State == StateRestarting {
 		return nil, fmt.Errorf("stack %q is still running — stop it first before deleting", name)
@@ -239,6 +244,11 @@ func (m *Manager) RemoveStack(name string, removeHDDData bool, backupPathsToRemo
 		return nil, fmt.Errorf("stack %q is not deployed", name)
 	}
 
+	// Must not be deploying (H2 fix)
+	if stack.Deploying {
+		return nil, fmt.Errorf("stack %q is currently being deployed — wait for deployment to finish", name)
+	}
+
 	// Must be stopped (not running)
 	if stack.State == StateRunning || stack.State == StateStarting || stack.State == StateRestarting {
 		return nil, fmt.Errorf("stack %q is still running — stop it first before removing", name)