Fix 7 critical security bugs and 1 high-severity data loss bug

- CSRF: HMAC-signed double-submit cookie (server-bound, not raw compare)
- Keychain: execFileSync with arg arrays to prevent command injection
- Caddy config: always use structured generation, never accept raw config
- Templates: replace {{GENERATED_SECRET}} with crypto.randomBytes
- Caddyfile removal: move regex inside ctx.caddy.modify() to fix TOCTOU race
- Credentials: proper-lockfile for all file operations, fix key rotation
  to decrypt with old key before generating new key
- Service removal: filter by ID only, not AND with appTemplate

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/app-templates.js

@@ -1323,7 +1323,7 @@ const APP_TEMPLATES = {
         "USER_GID": "1000"
       }
     },
-    subdomain: "git",
+    subdomain: "gitea",
     defaultPort: 3005,
     healthCheck: "/",
     subpathSupport: 'native',