Fix 9 critical code review issues: validation, error handling, and security

[Copilot]

This PR addresses 9 critical issues identified in the AI code review, implementing minimal surgical fixes to improve robustness and security without breaking existing functionality.

Issues Fixed

1. Non-interactive game validation failure

• Modified GameConfig.Validate() to allow empty Target for DirectPath mode in automated environments
• Enables gabs games add to work in CI/CD pipelines and scripts
• Updated tests to reflect new validation logic

2. CLI references non-existent command

• Removed reference to unimplemented gabs games edit command in success messages
• Updated message to guide users to manual configuration instead

3. HTTP server startup error handling

• Fixed ServeHTTP to properly propagate startup errors instead of swallowing them
• Server now exits with proper error codes when HTTP binding fails
• Prevents silent failures that could confuse users

4. Connection leak in writer cleanup

• Fixed writer slice cleanup logic that could leak connections when multiple clients disconnect
• Changed from index-based removal to value-based search to handle concurrent disconnections safely

5. Memory safety in config access

• Updated GetGame() to return a safe copy instead of a pointer to map value
• Prevents accidental modifications that wouldn't persist to the underlying map

6. Input validation for backoff parameters

• Added validation for negative durations and min > max ordering in parseBackoff
• Prevents configuration errors that could cause unexpected behavior

7. Error visibility in process restart

• Modified Controller.Restart() to log stop errors while continuing with restart
• Improves debugging without breaking restart functionality when processes are already dead

8. HTTP request body size limits

• Added 1MB size limit to HTTP MCP request bodies using http.MaxBytesReader
• Prevents potential memory exhaustion attacks via large request bodies

9. Documentation clarity for Steam/Epic games

• Enhanced README to emphasize that stopProcessName is required for Steam/Epic games
• Makes it clear this is critical for proper game termination, not optional

Testing

• All existing tests pass
• Added new test for empty Target validation
• Manual testing confirms:
  • Backoff validation rejects invalid inputs
  • Non-interactive game addition works correctly
  • HTTP server errors are properly reported
  • CLI help no longer references non-existent commands

Impact

These changes improve the robustness and security of GABS while maintaining full backward compatibility. The fixes are minimal and surgical, reducing regression risk while addressing real issues that could affect production deployments.

Fixes #41.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.