fix: Phase 5 — XSS sanitization, cookie security, redirect validation, input trimming

- BootScreen + Settings: v-html now uses DOMPurify.sanitize() for SVG content
- FileBrowser cookie: added Secure flag and 24h expiration
- TOTP secret: hidden by default with reveal toggle button
- Login redirect: validates URL is local-origin before redirecting
- Auth fields: password inputs trimmed before submission
- Route params: appId validated against safe pattern, invalid IDs redirect to /apps

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/views/AppSession.vue

@@ -264,7 +264,14 @@ const panelClasses = computed(() => {
   return `${base} app-session-overlay`
 })
 
-const appId = computed(() => props.appIdProp || (route.params.appId as string))
+const appId = computed(() => {
+  const id = props.appIdProp || (route.params.appId as string)
+  if (typeof id !== 'string' || !/^[a-z0-9][a-z0-9._-]*$/.test(id) || id.length > 64) {
+    router.replace('/apps')
+    return ''
+  }
+  return id
+})
 
 /** Container apps: direct port access (avoids root-relative asset breakage under /app/xxx/ proxy) */
 const APP_PORTS: Record<string, number> = {