fix(security): harden CodeQL findings across console and Go server

Address GitHub code scanning alerts with OIDC SSRF guards, confined path
helpers, safer client routing, branding sanitization, upload rate limits,
and CodeQL config exclusions for dev-only and protocol-intentional hashes.

web-nodejs/scripts/dev-i18n/apply-i18n-audit.js

@@ -45,17 +45,26 @@ function flattenKeys(obj, prefix = '', result = new Map()) {
     return result;
 }
 
+const UNSAFE_NESTED_KEYS = new Set(['__proto__', 'prototype', 'constructor']);
+
 function setNested(obj, dotPath, value) {
     const parts = dotPath.split('.');
     let cur = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const p = parts[i];
+        if (UNSAFE_NESTED_KEYS.has(p)) {
+            throw new Error(`Unsafe key segment: ${p}`);
+        }
         if (!cur[p] || typeof cur[p] !== 'object' || Array.isArray(cur[p])) {
             cur[p] = {};
         }
         cur = cur[p];
     }
-    cur[parts[parts.length - 1]] = value;
+    const leaf = parts[parts.length - 1];
+    if (UNSAFE_NESTED_KEYS.has(leaf)) {
+        throw new Error(`Unsafe key segment: ${leaf}`);
+    }
+    cur[leaf] = value;
 }
 
 function collectPatchEntries(patch, prefix = '', entries = []) {