feat: admin File Manager with root filesystem access + dangerous-path safety guard

- New File Manager page under Admin > System, built on the existing /api/files endpoint (admin sessions with no linked hosting account get baseDir=/, i.e. full filesystem).

- Fixed two baseDir=/ edge-case bugs in files.php: safe_path() double-slash prefix check, and list actions path stripping via str_replace corrupting every slash.

- Added download and chown actions to files.php.

- Added a server-enforced dangerous-path guard: write/delete/rename/chmod/chown/mkdir/upload/compress/extract targeting /etc,/boot,/root,/sys,/proc,/dev,/run,/lib*,/bin,/sbin,/var/lib,/snap are rejected with 409 unless confirm_dangerous=true is sent - matched by a client-side warning modal requiring a checkbox and typed CONFIRM.

- install.sh: added zip package (required by the existing compress action, was missing).

install.sh

@@ -133,7 +133,7 @@ export DEBIAN_FRONTEND=noninteractive
 apt-get update -qq >> "$LOG" 2>&1
 apt-get upgrade -y -qq >> "$LOG" 2>&1
 apt-get install -y -qq curl wget gnupg2 lsb-release ca-certificates \
-  software-properties-common apt-transport-https unzip git \
+  software-properties-common apt-transport-https zip unzip git \
   sudo cron logrotate ufw fail2ban sshpass sqlite3 >> "$LOG" 2>&1
 log "System packages updated"