Harden web UI auth, input handling, and SD path validation

- Add optional Basic Auth with NVS-backed credentials and STA/AP flags; protect status, wifi, history, and download routes

- Stop pre-filling WiFi/MQTT/Web UI password fields; keep stored secrets on blank and add clear-password checkboxes

- Add HTML escaping + URL encoding helpers and apply to user-controlled strings; add unit test

- Harden /sd/download path validation (prefix, length, dotdot, slashes) and log rejections

- Enforce protocol version in LoRa receive and release GPIO14 before SD init

- Update README security, SD, and GPIO sharing notes

src/lora_transport.cpp

@@ -85,6 +85,9 @@ bool lora_receive(LoraPacket &pkt, uint32_t timeout_ms) {
       if (crc_calc != crc_rx) {
         return false;
       }
+      if (buffer[0] != PROTOCOL_VERSION) {
+        return false;
+      }
 
       pkt.protocol_version = buffer[0];
       pkt.role = static_cast<DeviceRole>(buffer[1]);