chore: bump version to 1.0.74 [skip ci]

upload only checked [path], which is parsed from JSON php://input and is always empty for multipart/form-data uploads. It silently fell back to a hardcoded /public_html, which does not exist at filesystem root - breaking uploads for the admin File Manager (baseDir=/) entirely, though it went unnoticed for regular hosting accounts since /public_html happens to be their real default. Now falls back through  and  as well.

VERSION

@@ -1 +1 @@
-1.0.73
+1.0.74

panel/api/endpoints/files.php

@@ -220,7 +220,7 @@ match ($action) {
     })(),
 
     'upload' => (function() use ($baseDir, $body) {
-        $dir = safe_path($baseDir, $body['path'] ?? '/public_html');
+        $dir = safe_path($baseDir, $body['path'] ?? $_POST['path'] ?? $_GET['path'] ?? '/public_html');
         require_dangerous_confirm($baseDir, $dir, $body);
         if (!is_dir($dir)) Response::error("Target directory not found");
         if (!is_writable($dir)) Response::error("Permission denied writing to this directory");