fix: memory safety and file handle leaks

[Swissola]

Summary

Five independent safety fixes found during code review. Each is a self-contained change with no functional impact on normal operation — all address edge-case crashes or undefined behaviour.

• MakeHexUtils.cpp — strcpy replaced with strncpy (+ explicit null terminator) when copying a line into the 1024-byte m_bufr. A .ir file line longer than 1023 bytes would overflow the buffer.
• FileRemoteCommand.h — operator== raw-data loop was bounded by the hardcoded literal 20 instead of lhs.rawDataSize. For commands with >20 samples the comparison silently stopped early; for commands with <20 it read past the allocated array.
• FileService.cpp — std::stoi / std::stof on the frequency: and duty_cycle: fields throw std::invalid_argument / std::out_of_range on malformed .ir files. Wrapped in try/catch with sensible defaults (38 kHz, 0.33 duty cycle).
• SdService.cpp — isFile() called f.close() on the directory path but not when the file was not a directory; listElements() did not close dir on the two early-return paths and leaked file handles at the limit break. All paths now explicitly close handles.
• RemoteRepository.cpp — FavoriteRemote favoriteRemote; is not zero-initialised in C++ (POD struct). If sscanf partially fills the struct the unused char arrays contain stack garbage. Changed to FavoriteRemote favoriteRemote = {}; to value-initialise all fields to zero before the sscanf.

Test plan

• Build with PlatformIO — no new warnings or errors
• Browse IR files including one with a malformed frequency: or duty_cycle: field — no crash
• Use Favorites (save, list, delete) — no garbled names

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud