Fix 7 critical security bugs and 1 high-severity data loss bug

- CSRF: HMAC-signed double-submit cookie (server-bound, not raw compare)
- Keychain: execFileSync with arg arrays to prevent command injection
- Caddy config: always use structured generation, never accept raw config
- Templates: replace {{GENERATED_SECRET}} with crypto.randomBytes
- Caddyfile removal: move regex inside ctx.caddy.modify() to fix TOCTOU race
- Credentials: proper-lockfile for all file operations, fix key rotation
  to decrypt with old key before generating new key
- Service removal: filter by ID only, not AND with appTemplate

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/routes/sites.js

@@ -155,12 +155,8 @@ module.exports = function(ctx) {
       return ctx.errorResponse(res, 409, `[DC-302] Site block for "${domain}" already exists in Caddyfile`);
     }
 
-    let newSiteBlock;
-    if (config) {
-      newSiteBlock = `\n${config}\n`;
-    } else {
-      newSiteBlock = `\n${domain} {\n    reverse_proxy ${upstream}\n    tls internal\n}\n`;
-    }
+    // Always generate structured config — never allow raw Caddy config injection
+    const newSiteBlock = `\n${domain} {\n    reverse_proxy ${upstream}\n    tls internal\n}\n`;
 
     const result = await ctx.caddy.modify(c => c + newSiteBlock);
     if (!result.success) {