Fix 7 critical security bugs and 1 high-severity data loss bug

- CSRF: HMAC-signed double-submit cookie (server-bound, not raw compare)
- Keychain: execFileSync with arg arrays to prevent command injection
- Caddy config: always use structured generation, never accept raw config
- Templates: replace {{GENERATED_SECRET}} with crypto.randomBytes
- Caddyfile removal: move regex inside ctx.caddy.modify() to fix TOCTOU race
- Credentials: proper-lockfile for all file operations, fix key rotation
  to decrypt with old key before generating new key
- Service removal: filter by ID only, not AND with appTemplate

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/routes/apps/helpers.js

@@ -1,6 +1,7 @@
 const fs = require('fs');
 const fsp = require('fs').promises;
 const path = require('path');
+const crypto = require('crypto');
 const { REGEX, DOCKER } = require('../../constants');
 const { exists } = require('../../fs-helpers');
 const platformPaths = require('../../platform-paths');
@@ -70,7 +71,8 @@ module.exports = function(ctx) {
       '{{SUBDOMAIN}}': config.subdomain,
       '{{PORT}}': config.port || template.defaultPort,
       '{{MEDIA_PATH}}': mediaPaths[0] || '/media',
-      '{{TIMEZONE}}': ctx.siteConfig.timezone || 'UTC'
+      '{{TIMEZONE}}': ctx.siteConfig.timezone || 'UTC',
+      '{{GENERATED_SECRET}}': crypto.randomBytes(32).toString('hex')
     };
 
     function replaceInObject(obj) {