fix(remote): symlink escape, decompression amplification, stalled requests

[bucknova]

Three findings from the adversarial security review of the embedded server.
All three verified against the real server, not just reasoned about.

1. Symlinks escaped the path-traversal fence

The opaque-id registry properly defeats client-supplied paths — the review
probed it with ../, double-encoding, absolute paths, ..;/ and null bytes,
and it held. But the registry is built by walking the gallery directories,
and Path.is_file() follows symlinks. So leak.png → ~/.ssh/id_rsa
dropped into a watched folder became a legitimate id whose bytes the server
served.

gallery_extra_dirs is documented as pointing at a shared folder, which is
precisely where someone else can create a symlink.

image_path() now resolves the target and requires containment;
thumbnail_path() inherits it. The entry still lists — filtering at scan
time would cost a resolve() per file per scan — but its bytes and thumbnail
are refused, which is the boundary that matters.

2. A 150 KB upload could allocate hundreds of megabytes

/api/compose/render needs only the token, not the TX gate. And Pillow's
MAX_IMAGE_PIXELS only raises above 2× the limit — between 1× and 2×
it warns and decodes anyway. So our 32 MP cap was really 64 MP, and a
solid-colour PNG declaring 7000×7000 compresses to ~150 KB, well under the
12 MB upload cap.

Nothing bounded concurrent renders either; the reviewer drove the server from
44 MB to 3.3 GB RSS with six requests.

open() is lazy, so the declared dimensions are now checked before
load().

3. Stalled connections held threads forever, unauthenticated

BaseHTTPRequestHandler leaves timeout at None. A client that sent half
a header line and stopped held a request thread indefinitely — and it's
parked before auth runs, so no token is needed. A few hundred such
connections exhaust the thread pool and the fd limit and block the accept
loop for the operator's own phone.

Requests now time out at 15 s. That bounds reading the request, not writing
an SSE response.

Verified

1. gallery lists 2 item(s): ['real.png', 'leak.png']
   symlink target served? no — blocked
2. 49 MP payload (152 KB): HTTP 400 — rejected
3. stalled connection closed after 15.0s (server hung up)

A note on the tests

Two regression tests. The compose one nearly shipped meaningless: it
passed without the fix, because a bogus template id made render() return
None before the decode was ever reached. It now uses a real template id and
asserts that a normal photo through the same call succeeds — so a None can
only be the cap. Same failure mode we flagged on #53, caught here by adding a
positive control.

109 passed in tests/remote; ruff clean.

🤖 Generated with Claude Code