audit follow-up: fix 39 open HIGH/MEDIUM findings (security, correctness, tests)

[hmziqagent]

Implements all 39 open HIGH/MEDIUM findings from docs/AUDIT-2026-06-30.md that remained after the prior "deep-audit HIGH/MEDIUM" commits. Partitioned into 15 atomic per-crate commits (each self-contained, its own crate green). The toride-service -- hardening is bundled with its downstream test ripples (wireguard/monitor/tailscale) so it reverts cleanly.

Security

• toride-service: systemctl now gets a -- separator + unit-name validation (flag-injection guard)
• toride-ssh-doctor: shell-quote the remote AuthorizedPrincipalsFile value before interpolation (injection); timeout ssh-keyscan
• toride-ssh/key: remove_from_config temp file uses O_EXCL (symlink-race)
• toride-proxy/certs: validate domain in cert-manager paths (traversal guard)
• toride-mise: verify bootstrap tarball sha256 before extraction (fail closed)
• toride-users/pam: make write_pam_config genuinely atomic (temp+rename)
• toride-users/totp: TOTP enrollment secret wrapped in a redacting+zeroizing TotpSecret
• toride-wireguard: volatile zeroize of key secret
• ufw-kit/command: wire redact_args into log emission + forward redact_logs

Correctness

• ufw-kit/doctor: fix !content.matches("COMMIT").count() >= 2 operator-precedence bug (NAT guard)
• ufw-kit/client: enable() honors exit code, not just non-empty stderr
• toride-backup: stop zeroing restic error_count when "no errors were found" appears
• toride-fail2ban: persist detector journal before returning a mid-scan error (prevents re-bans)
• toride-ui/validate: MinLength/MaxLength count chars, not bytes
• toride-ui/header: net-None gauge hitbox consistency

Test coverage (gaps closed)

SSH sub-tab CRUD ops across all 8 tabs, gauge_hitboxes+width helpers, sidebar render, toride-audit (auditd_config/backup/config/doctor), installer TooLarge size-cap, mise config_set_toml_edit, AST round-trip proptest, serialized env-mutating config tests, collect_authorized_keys_preview, status-collector predicate, test-only App ctor.

Refactor / perf / async

• toride-cloud: one shared From<toride_runner::Error> (was duplicated per provider)
• toride-ssh-doctor: route remote checks through &dyn CliRunner; resolve host config once per run_all
• toride: dedupe execute_op logging; batch macOS dscl user-shell query (O(N)→O(1)); offload installer verify/extract/write to spawn_blocking; timeout ssh_write_task on quit

Verification

• cargo build --workspace ✅
• cargo clippy --workspace --all-targets -- -D warnings ✅ clean
• cargo test --workspace ✅ 5936 passed
• Each of the 15 implementation groups self-verified green before commit.
• One pre-existing flake, toride-runner::stdin_to_exiting_command_succeeds, is not touched by this PR (toride-runner is unmodified) and passes in isolation; it intermittently fails under workspace-wide parallel load regardless of this change.

Notes

• 54 files, +5230/−874.
• docs/AUDIT-2026-06-30.md is intentionally excluded (separate decision on whether to commit the audit report).
• The remaining LOW/INFO findings (~141, mostly open) are a follow-up.