Pre-stable hardening: auth, vhost TLS, path handling, DNS, plugin startup

[mirkobrombin]

Pre-stable hardening pass. Fixes a set of correctness, security and robustness issues found while reviewing the project before tagging it stable.

Security

• API and Dashboard now fail closed: they refuse to start without credentials, and the auth middlewares deny instead of skipping when unconfigured.
• Path handling centralised through validated helpers (domain validation + containment), closing the CodeQL go/path-injection findings on api/sites.go, config.go, logs_explorer.go and php.go.
• Auth plugin sessions are now bound to a random cookie token instead of the spoofable client IP; password comparison is constant time.
• Virtual-host servers no longer silently drop TLS: one certificate per domain is loaded and selected by SNI.
• DNS zone matching now respects label boundaries (no more answering for lookalike domains) and the forwarder enforces a recursion ACL (default loopback/private) to avoid acting as an open resolver.
• /docker/ container listing is gated per site on the plugin being enabled.
• Restricted file permissions for config and log files.

Correctness / robustness

• restart re-execs start (not itself) after the old process has actually exited; stop polls for exit instead of Wait on a non-child.
• Plugins are initialised serially before any server serves, removing a shared-map data race and a double init.
• Graceful shutdown and restart now cover HTTP/3 and DNS servers, not just the last HTTP server.
• Default server timeouts (read / read-header / idle) plus proxy ResponseHeaderTimeout to mitigate slowloris and hung upstreams.
• Date-based log rotation so long-running processes write to the correct day's file.
• NodeJS plugin runs one process per domain; SafeGuard is wired up and measures live RSS.
• Static handler blocks dotfiles, refuses an empty root, and no longer panics on a vanished directory entry.
• Global config file is no longer loaded as a phantom site; DockerStandard only pulls/builds when enabled.
• Toolchain pinned to go1.26.5 to clear the reachable standard-library advisories.

Verification

• go build ./... (+ web_only / dns_only tags), go vet, gofmt: clean.
• go test -race ./...: all green (added tests for domain/path validation and DNS zone boundary).
• govulncheck ./...: 0 vulnerabilities.
• Runtime smoke tests: dotfile blocked, empty-root not exposed, API refuses to start without a token, two TLS vhosts served over HTTPS via SNI with plaintext rejected.