security: harden dashboard (SSH keys, auth, uploads, CORS, non-root)

Remove SSH private keys from git, add SECRET_KEY validation, move WS
auth from query string to first message, add session limits/idle timeout,
PBKDF2 Fernet key, refresh token rotation, TOTP replay protection,
file upload size limit + filename sanitization, symlink safety check,
restrict CORS methods, IP-gate OpenClaw token, run container as non-root,
rate-limit refresh/passkey endpoints, sanitize Gitea path params.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/backend/routers/docker_router.py

@@ -1,5 +1,5 @@
 import docker
-from fastapi import APIRouter
+from fastapi import APIRouter, Query
 from config import DOCKER_HOST
 
 router = APIRouter()
@@ -31,6 +31,6 @@ def container_action(container_id: str, action: str):
 
 
 @router.get("/containers/{container_id}/logs")
-def container_logs(container_id: str, tail: int = 200):
+def container_logs(container_id: str, tail: int = Query(200, le=10000)):
     c = client.containers.get(container_id)
     return {"logs": c.logs(tail=tail, timestamps=True).decode(errors="replace")}