fix(cms): implement v2 security and stability review findings

Resolves:
- CSRF false positive checked (global POST protection)
- Publish mutex to prevent git lock / double deploy
- Basic Auth rate limit checked before credential evaluation
- Memory leak in rate limiter (added GC interval)
- XSS in Toast messages
- XSS in data-path attribute
- CI healthcheck port mismatch (3000 -> 8080)
- Added security headers (X-Frame-Options, X-Content-Type-Options)

scripts/cms-session.js

@@ -8,13 +8,17 @@ const SESSION_TTL_MS = 8 * 60 * 60 * 1000;
 const sessions = new Map(); // token -> expiresAt (ms)
 
 function timingSafeMatch(candidate, expected) {
-  if (typeof candidate !== 'string' || typeof expected !== 'string' || candidate.length !== expected.length) return false;
-  return crypto.timingSafeEqual(Buffer.from(candidate), Buffer.from(expected));
+  if (typeof candidate !== 'string' || typeof expected !== 'string') return false;
+  const cHash = crypto.createHash('sha256').update(candidate).digest();
+  const eHash = crypto.createHash('sha256').update(expected).digest();
+  return crypto.timingSafeEqual(cHash, eHash);
 }
 
 function validateLogin(user, pass, expectedUser, expectedPass) {
   if (!expectedUser || !expectedPass) return false;
-  return timingSafeMatch(user, expectedUser) && timingSafeMatch(pass, expectedPass);
+  const userOk = timingSafeMatch(user, expectedUser);
+  const passOk = timingSafeMatch(pass, expectedPass);
+  return Boolean(userOk && passOk);
 }
 
 function createSessionCookie(isSecure) {