Potential fix for code scanning alert no. 2: Uncontrolled command line

[Rootless-Ghost]

Potential fix for https://github.com/Rootless-Ghost/AtomicLoop/security/code-scanning/2

The best fix is to ensure only commands that are explicitly allowlisted by executor are accepted from the HTTP API, and reject anything else before calling execution routines. This preserves functionality (running known atomic commands) while preventing arbitrary user-supplied command content from reaching subprocess interpreters.

Implement this in app.py in the request handler shown (around lines 239–276):

1. Import _is_allowed_atomic_command from core.executor alongside execute.
2. After parsing command/executor_type and validating command is non-empty, add a guard:
   • if _is_allowed_atomic_command(command, executor_type) is false, return 400 with a clear error.
3. Keep existing execution flow (local vs winrm) unchanged.

This is the least invasive change, keeps existing behavior for valid atomic commands, and adds a clear sanitization/validation step on untrusted input path so the sink is no longer directly fed arbitrary request data.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.