[grade=A] P0-3: backups config route — destructure req.body to backups/defaultRetention only

dashcaddy-api/routes/backups.js

@@ -484,7 +484,14 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
 
   // Update backup configuration
   router.post('/backups/config', asyncHandler(async (req, res) => {
-    backupManager.updateConfig(req.body);
+    // P0-3 fix: was `backupManager.updateConfig(req.body)` which allowed
+    // arbitrary keys from HTTP request body to be merged into persisted config.
+    // Now destructure only the two known top-level fields.
+    const { backups, defaultRetention } = req.body || {};
+    const patch = {};
+    if (backups !== undefined) patch.backups = backups;
+    if (defaultRetention !== undefined) patch.defaultRetention = defaultRetention;
+    backupManager.updateConfig(patch);
     success(res, { message: 'Backup configuration updated' });
   }, 'backups-config-update'));