fix(cms): implement v2 security and stability review findings

Resolves:
- CSRF false positive checked (global POST protection)
- Publish mutex to prevent git lock / double deploy
- Basic Auth rate limit checked before credential evaluation
- Memory leak in rate limiter (added GC interval)
- XSS in Toast messages
- XSS in data-path attribute
- CI healthcheck port mismatch (3000 -> 8080)
- Added security headers (X-Frame-Options, X-Content-Type-Options)

scripts/cms-core.js

@@ -28,6 +28,24 @@ function getClientAddress(req) {
   return req.socket.remoteAddress || 'unknown';
 }
 
+function isRateLimited(key, limit, windowMs) {
+  const now = Date.now();
+  const attempts = (rateLimits.get(key) || []).filter(time => now - time < windowMs);
+  if (attempts.length === 0) {
+    rateLimits.delete(key);
+    return false;
+  }
+  rateLimits.set(key, attempts);
+  return attempts.length >= limit;
+}
+
+function recordRateLimitAttempt(key, windowMs) {
+  const now = Date.now();
+  const attempts = (rateLimits.get(key) || []).filter(time => now - time < windowMs);
+  attempts.push(now);
+  rateLimits.set(key, attempts);
+}
+
 function exceedsRateLimit(key, limit, windowMs) {
   const now = Date.now();
   const attempts = (rateLimits.get(key) || []).filter(time => now - time < windowMs);
@@ -38,7 +56,10 @@ function exceedsRateLimit(key, limit, windowMs) {
 
 function hasValidCredentials(req, validateLogin) {
   const b64auth = (req.headers.authorization || '').split(' ')[1] || '';
-  const [login = '', password = ''] = Buffer.from(b64auth, 'base64').toString().split(':');
+  const str = Buffer.from(b64auth, 'base64').toString();
+  const colonIdx = str.indexOf(':');
+  const login = colonIdx !== -1 ? str.slice(0, colonIdx) : str;
+  const password = colonIdx !== -1 ? str.slice(colonIdx + 1) : '';
   return validateLogin(login, password, CMS_USER, CMS_PASS);
 }
 
@@ -84,6 +105,17 @@ function backupAndWriteAtomically(targetFile, data, backupDir) {
   return backupFile;
 }
 
+
+const RATE_LIMIT_GC_INTERVAL_MS = 5 * 60 * 1000;
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, attempts] of rateLimits) {
+    const valid = attempts.filter(t => now - t < 15 * 60 * 1000);
+    if (valid.length === 0) rateLimits.delete(key);
+    else rateLimits.set(key, valid);
+  }
+}, RATE_LIMIT_GC_INTERVAL_MS).unref();
+
 module.exports = {
   CMS_USER,
   CMS_PASS,
@@ -91,6 +123,8 @@ module.exports = {
   CSRF_TOKEN,
   securityConfigIsValid,
   getClientAddress,
+  isRateLimited,
+  recordRateLimitAttempt,
   exceedsRateLimit,
   hasValidCredentials,
   isBrowserNavigation,