Fix 5 critical security vulnerabilities

1. WebSocket exec auth bypass (exec.js): Require valid JWT or API key
   before accepting WebSocket upgrade. Reject unauthenticated requests
   with 401 before the upgrade completes.

2. Shell injection in router auto-login (session-handlers.js): Validate
   baseUrl against safe hostname pattern before embedding in wget shell
   command. Reject with null session if invalid.

3. Path traversal in credentials routes (services.js): Add explicit
   serviceId validation (alphanumeric + dash/underscore/dot, max 100
   chars) to all three credential endpoints. Removed redundant
   try/catch wrapper.

4. execSync injection in CA CSR generation (ca.js): Add sanitize step
   replacing any non-alphanumeric domain chars with underscore before
   interpolation into shell subj argument. Redundant with existing
   validation but provides defense-in-depth.

5. Auth bypass when TOTP disabled (middleware.js): Split the logic
   cleanly — disabled TOTP means no auth (initial setup state), enabled
   TOTP means all auth methods checked (session/JWT/API key). Removed
   the sessionDuration:never conflating shortcut.

dashcaddy-api/middleware.js

@@ -316,9 +316,16 @@ module.exports = function configureMiddleware(app, {
 
   // ── TOTP auth middleware ──
   const totpAuthMiddleware = (req, res, next) => {
-    if (!totpConfig.enabled || totpConfig.sessionDuration === 'never') {
+    // If TOTP is not enabled at all, skip auth entirely — this is the initial-setup state
+    if (!totpConfig.enabled) {
+      req.auth = {
+        type: 'none',
+        scope: ['admin']
+      };
       return next();
     }
+
+    // TOTP is enabled — require a valid session, JWT, or API key
     if (isPublicRoute(req)) return next();
     if (isSessionValid(req)) return next();
 
@@ -369,14 +376,7 @@ module.exports = function configureMiddleware(app, {
       }
     }
 
-    if (!totpConfig.enabled || totpConfig.sessionDuration === 'never') {
-      req.auth = {
-        type: 'none',
-        scope: ['admin']
-      };
-      return next();
-    }
-
+    // No valid auth — reject
     return res.status(401).json({
       success: false,
       error: '[DC-110] Authentication required - provide TOTP session, JWT token, or API key',