fix: implement 22 security pentest remediation fixes

Server-side session management with SHA-256 hashed tokens and HttpOnly
cookies. Auth middleware gating all RPC/WS/proxy routes with method
allowlist. Login rate limiting (5/60s per IP). CORS restricted to
config origin. Docker registry allowlist. App ID and path validation.
P2P message sanitization (HTML + log injection). Onion address and
known-peer validation. Nginx security headers (CSP, X-Frame-Options,
etc.) and AIUI proxy auth. Systemd hardening (non-root, NoNewPrivileges,
ProtectSystem).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/archipelago/src/node_message.rs

@@ -113,6 +113,8 @@ pub async fn send_to_peer(onion: &str, from_pubkey: &str, message: &str) -> Resu
 
 /// Check if a peer is reachable (ping over Tor).
 pub async fn check_peer_reachable(onion: &str) -> Result<bool> {
+    validate_onion(onion)?;
+
     let host = if onion.ends_with(".onion") {
         onion.to_string()
     } else {