fix(security): enforce stack name validation on all routes (#314)

Audit found 11 routes with no stackName validation and 2 using a weaker
manual check. All 13 now use the canonical isValidStackName() guard
(^[a-zA-Z0-9_-]+$), returning 400 with { error: 'Invalid stack name' }.

docs/openapi.yaml

@@ -85,9 +85,13 @@ components:
       name: stackName
       in: path
       required: true
-      description: Stack directory name (URL-encoded if it contains special characters).
+      description: >
+        Stack directory name. Must match `^[a-zA-Z0-9_-]+$` (alphanumeric characters,
+        hyphens, and underscores only). Returns `400 Invalid stack name` if the name
+        contains path separators, dots, spaces, or other special characters.
       schema:
         type: string
+        pattern: '^[a-zA-Z0-9_-]+$'
         example: my-stack
     nodeId:
       name: x-node-id