Complete GHSA-3v82-3gf8-fxx8 WebSocket replay fix for soft-deleted peers, bump vulnerable Go/Rust dependencies, and apply CodeQL-driven hardening (OIDC URL validation, path confinement, execFileSync, rate limits).
Hardened installs could not replace betterdesk-server in /opt/rustdesk from Settings → Updates. Add a validated sudo deploy helper, extend console update sudoers, and sync privileges before server deploy. Fixes #183