Hardening: whitelist for service runner

[TrystanLea]

This PR proposes replacing the free-form string protocol with a structured JSON payload and a server-side whitelist:

{"run": "emoncms-update", "args": ["all", "none", "/dev/ttyUSB0"], "log": "update"}

• The daemon maps symbolic action codes to hardcoded absolute script paths — no script path crosses the Redis boundary
• Log destinations are resolved from a hardcoded LOG_WHITELIST — no longer caller-controlled
• Unknown actions, unknown log names, wrong arg counts, and non-string args are hard-rejected
• The four PHP models (UpdateModel, ComponentsModel, ServiceModel, SerialModel) are updated to push JSON action codes instead of constructing script path strings