security: RBAC viewer role, identity label length, error sanitization

- RBAC: Viewer role changed from prefix "system." to explicit allowlist
  of safe read-only methods. Prevents Viewer access to system.factory-reset,
  system.shutdown, system.reboot, system.disk-cleanup.
- identity.create: Name/label param now enforces max 100 chars.
- sanitize_error_message: Changed from contains() to starts_with() for
  prefix matching, preventing internal errors that happen to contain
  user-facing keywords from leaking through.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/mod.rs

@@ -87,7 +87,7 @@ fn sanitize_error_message(msg: &str) -> String {
         "Session",
     ];
     for prefix in &user_facing_prefixes {
-        if msg.starts_with(prefix) || msg.contains(prefix) {
+        if msg.starts_with(prefix) {
             // Truncate long messages and strip file paths
             let sanitized = msg.replace("/var/lib/archipelago/", "[data]/")
                 .replace("/usr/local/bin/", "[bin]/")