Resolve all CodeQL and Dependabot findings (v2.6.40)

[ttlequals0]

Summary

Bundle PR resolving every open finding under Security:

• 77 open CodeQL alerts (49 stack-trace-exposure, 7 path-injection, 17 reflective-xss, 3 clear-text-logging, 1 actions/missing-workflow-permissions)
• 8 open Dependabot alerts (Pillow, requests, Flask-CORS x3, pytest, black x2)
• Closes the 5 open Dependabot PRs (Bump pillow from 12.1.1 to 12.2.0 #49, Bump requests from 2.32.5 to 2.33.0 #50, Bump flask-cors from 5.0.1 to 6.0.0 #51, Bump pytest from 8.3.5 to 9.0.3 #52, Bump black from 23.11.0 to 26.3.1 #53) that this PR supersedes (will close manually after merge)

Code changes

Stack-trace exposure (49 sites)

Exception detail (str(e), traceback, details) no longer appears in API error responses. The handle_errors decorator and every route-level except across the API blueprints returns a generic error message; the exception is logged server-side with exc_info=True for operators.

Path injection (7 sites)

validate_file_path and validate_directory_path resolve symlinks via os.path.realpath and validate with os.path.commonpath against the configured allowlist, defeating symlink-based escapes. New private helper _is_within_allowed factors the duplicated check.

Behavior change: validate_directory_path now enforces the configured scan-path allowlist by default. POST /api/scan, POST /api/scan-files-parallel, and POST /api/parallel/scan will reject directories outside SCAN_PATHS or the active ScanConfiguration entries (previously only .. / ~ tokens were rejected). POST /api/configurations is exempt because it is defining a new allowlist entry.

The unused validate_path_exists decorator is removed.

Clear-text logging (3 sites)

tools/migrate_to_postgres.py keeps the DB password in a dedicated parameter rather than the pg_config dict so it cannot share scope with logged connection details. Trusted-host config logging in security.py demoted from info to debug.

Workflow permissions

.github/workflows/test.yml declares permissions: contents: read at the workflow level (CodeQL minimum-privilege guidance).

Reflective XSS (17 alerts)

Every flagged site returns JSON via jsonify() with no HTML sink. To be dismissed in GitHub as false positives after this PR merges. No code change.

Dependency bumps

• Pillow 12.1.1 -> 12.2.0 (FITS GZIP decompression bomb)
• requests 2.32.5 -> 2.33.0 (extract_zipped_paths tempfile reuse)
• Flask-CORS 5.0.1 -> 6.0.0 (3 CVEs around path matching; wildcard config in app.py is unaffected by v6 specificity and case-sensitivity changes)
• pytest 8.3.5 -> 9.0.3 (tmpdir handling)
• black removed from requirements-test.txt: unused dev tooling (no CI gate, no pyproject.toml, no pre-commit hook); drops the 2 black CVEs entirely

Test plan

• pytest suite (pytest -m "not real_media"): 309 passed, 8 skipped, 10 deselected
• Frontend build (npm run build): webpack compiled successfully
• App import smoke (python -c "import app"): loads with new dependencies
• /simplify pass: factored two duplicated patterns into helpers (_is_within_allowed in security.py, _scan_conflict_response in scan_routes.py); dropped dead 'details': None keys; added exc_info=True to every previously-leaking logger.error site
• /review pass: reviewer flagged a same-class leak in maintenance_routes async handlers (CleanupState/FileChangesState progress_message) -- fixed in this PR; behavior change for validate_directory_path documented in CHANGELOG
• Reviewer to verify Flask-CORS v6 preflight headers in staging if desired
• CodeQL re-scan after merge: expect 0 open alerts (49 fixed in code + 17 dismissed + 7 fixed + 3 fixed + 1 fixed)
• Dependabot re-scan after merge: expect 0 open alerts