Better WebConsole

Security

• Added same-origin protection for authenticated API POST requests.
• Added same-origin protection for WebSocket handshakes.
• Tightened Content Security Policy for scripts and WebSocket connections.
• Added HSTS automatically when security.secure-cookies is enabled.
• Added login request body size limits.
• Added POSIX owner-only permission hardening for users.dat, sessions.tsv and audit.log.

Fixed

• Fixed active web sessions becoming unstable after restart because refreshed session activity was not persisted.
• Fixed WebSocket reconnects resetting per-session command rate limits.
• Fixed invalid CIDR whitelist prefixes matching unintended IP addresses.
• Fixed audit log shutdown potentially dropping queued entries.
• Aligned web login username validation with /bwc adduser rules.

Performance

• Cached dummy bcrypt verification hash for unknown-user login attempts.
• Cached world/entity stats between stats collection ticks.
• Limited and compacted persisted player activity history.
• Cached player activity summary counters.