Security hardening: fix SQL injection, WAF bypass, placeholder injection, and more

- C1: Replace all ClickHouse string interpolation with parameterized queries
  (query_params) to eliminate SQL injection in analytics endpoints
- C3: Strip Caddy placeholder patterns from redirect rules, protected paths,
  and Authentik auth endpoint to prevent config injection
- C4: Replace WAF custom directive blocklist with allowlist approach — only
  SecRule/SecAction/SecMarker/SecDefaultAction permitted; block ctl:ruleEngine
  and Include directives
- H2: Validate GCM authentication tag is exactly 16 bytes before decryption
- H3: Validate forward auth redirect URIs (scheme, no credentials) to prevent
  open redirects
- H4: Switch 11 analytics/WAF/geoip endpoints from session-only requireAdmin
  to requireApiAdmin supporting both Bearer token and session auth
- H5: Add input validation for instance-mode (whitelist) and sync-token
  (32-char minimum) in settings API
- M1: Add non-root user to l4-port-manager Dockerfile
- M5: Document Caddy admin API binding security rationale
- Document C2 (custom config injection) and H1 (SSRF via upstreams) as
  intentional admin features

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/analytics/user-agents/route.ts

@@ -1,15 +1,19 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { requireAdmin } from '@/src/lib/auth';
+import { requireApiAdmin, apiErrorResponse } from '@/src/lib/api-auth';
 import { getAnalyticsUserAgents, INTERVAL_SECONDS } from '@/src/lib/analytics-db';
 
 export async function GET(req: NextRequest) {
-  await requireAdmin();
-  const { searchParams } = req.nextUrl;
-  const hostsParam = searchParams.get('hosts') ?? '';
-  const hosts = hostsParam ? hostsParam.split(',').filter(Boolean) : [];
-  const { from, to } = resolveRange(searchParams);
-  const data = await getAnalyticsUserAgents(from, to, hosts);
-  return NextResponse.json(data);
+  try {
+    await requireApiAdmin(req);
+    const { searchParams } = req.nextUrl;
+    const hostsParam = searchParams.get('hosts') ?? '';
+    const hosts = hostsParam ? hostsParam.split(',').filter(Boolean) : [];
+    const { from, to } = resolveRange(searchParams);
+    const data = await getAnalyticsUserAgents(from, to, hosts);
+    return NextResponse.json(data);
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
 }
 
 function resolveRange(params: URLSearchParams): { from: number; to: number } {