fix: 5 critical/high-priority bugs (auth bypass, relay failures, unbounded recursion, context growth) (#1083)

* fix: address 5 critical and high-priority bugs from issue tracker

- #1033: reject webhook requests when secret is cleared at runtime via
  update_secret(None), preventing auth bypass through SIGHUP hot-swap
- #908: reset consecutive_failures counter on successful SSE stream
  reconnection in relay channel, so circuit breaker counts truly
  consecutive failures
- #975: add depth limit (16) to validate_tool_schema() to prevent
  stack overflow on deeply nested schemas
- #974: add depth limit (8) to resolve_nested() to prevent stack
  overflow on deeply nested capabilities wrappers
- #826: truncate oversized tool outputs (>8KB) in routine lightweight
  loop to prevent unbounded context growth across iterations

Each fix includes a regression test.

Closes #1033, #908, #975, #974, #826

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: 5 more high-priority bugs (routine cache, job signals, input limits)

- #1077: recompute next_fire_at when re-enabling cron routines via web
  toggle, mirroring CLI behavior so cron ticker picks them up
- #1076: refresh event trigger cache after web toggle/delete operations
  so event/system_event routines reflect changes immediately
- #892: remove Stuck from check_signals() stop-states in JobDelegate
  since Stuck is recoverable (Stuck -> InProgress via self-repair)
- #976: truncate oversized description strings in CapabilitiesFile to
  4KB to prevent memory abuse from malicious capabilities files
- #977: drop oversized parameters schema JSON (>64KB) in
  CapabilitiesFile to prevent unbounded memory growth

Each fix includes regression tests where applicable.

Closes #1077, #1076, #892, #976, #977

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: prevent ReDoS in event trigger regex patterns

- #825: use RegexBuilder with 64KB size limit when compiling
  user-supplied event trigger patterns, both at creation time
  (routine tool) and at cache refresh (routine engine)

Note: Rust's regex crate already guarantees O(n) matching, so the
size limit prevents excessive memory use during compilation rather
than catastrophic backtracking at match time.

Closes #825

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Harden HTTP SSRF IP filtering

* Apply rustfmt after staging merge

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

src/channels/relay/channel.rs

@@ -294,6 +294,8 @@ impl Channel for RelayChannel {
                 match client.connect_stream(&token, stream_timeout_secs).await {
                     Ok((new_stream, new_parser)) => {
                         tracing::info!("Relay SSE stream reconnected");
+                        consecutive_failures = 0;
+                        backoff_ms = backoff_initial_ms;
                         current_stream = new_stream;
                         // Abort old parser before replacing
                         if let Some(old) = parser_handle.write().await.take() {
@@ -312,6 +314,8 @@ impl Channel for RelayChannel {
                                         tracing::info!(
                                             "Relay SSE stream reconnected with new token"
                                         );
+                                        consecutive_failures = 0;
+                                        backoff_ms = backoff_initial_ms;
                                         current_stream = new_stream;
                                         if let Some(old) = parser_handle.write().await.take() {
                                             old.abort();