Fix all open CodeQL code scanning alerts

[matveynator]

What changed

This PR addresses all 41 CodeQL alerts currently open on main:

• 3 high-severity weak password hashing alerts
• 2 high-severity clear-text sensitive logging alerts
• 1 high-severity allocation overflow alert
• 35 medium-severity log injection alerts

Password protection

• Replaced the fast SHA-256 page-password digest with bcrypt.
• Added an HMAC-SHA256 prehash so passwords of any length can be handled before bcrypt's input limit.
• Replaced the password-derived cookie identifier with a non-secret FNV identifier.
• Replaced the unkeyed session digest with HMAC-SHA256 and constant-time HMAC verification.
• Propagated password-hashing and database write errors explicitly.
• Added tests proving bcrypt matching, long-password support, incorrect-password rejection, and rejection of the legacy fast digest.

Existing page-protection rules stored with the legacy sha256: digest intentionally stop authenticating. An administrator must set a new password for those protected paths after deployment. Keeping a legacy verifier would preserve the vulnerable password mechanism that these alerts identify.

Logging

• Removed SQL statement text from database worker and router diagnostics so password/token schema details cannot reach logs.
• Sanitized request, domain, path, URL, relay, error, and other externally influenced fields before terminal or persistent logging.
• Sanitized messages again at the domain/problem log storage boundary.
• Stopped logging session tokens, complete recipient addresses, email subjects, and disk-alert owner addresses.
• Added a regression test for CR/LF/control-character removal.

Allocation safety

• Added an explicit integer overflow guard before calculating the combined HTML and injected modal size.

Root causes

The page-protection subsystem used a fast digest for passwords and an unkeyed digest for session binding. Diagnostic logging accepted externally influenced strings and complete SQL summaries without a mandatory sanitization boundary. One slice-capacity calculation relied on practical memory limits instead of proving that integer addition could not overflow.

Validation

• GOCACHE=/private/tmp/sitebrush-gocache go test -count=1 ./pkg/... ./scripts/...
• Focused root security, demo, page-password, and template-rendering tests
• gosec -include=G703,G704 ./... — 0 issues
• git diff --check

The GitHub CodeQL workflow is the final validation for the exact security-extended query suite used to create these alerts.