refactor(backend): sanitize user input before logging to close CRLF injection (#807)

* refactor(backend): sanitize user input before logging to close CRLF injection

Adds a small sanitizeForLog helper that strips CR, LF, tab, and ASCII
control characters (0x00-0x1F, 0x7F) from a value before it is embedded
in a console.log/warn/error/debug call. Wraps every call site where a
user-controlled value (req.params, req.body, req.query, or a value
derived from them) flows into a log message.

Closes the bulk of the open CodeQL alerts in this family:
- 96 js/log-injection
- 28 js/tainted-format-string

The helper is in backend/src/utils/safeLog.ts. Routes still pre-validate
input at the request boundary; this is the second line of defense and
gives static analyzers a sanitizer they can trace through. JSON
responses, Docker filter labels, and other non-log call sites are
intentionally left unwrapped.

* refactor(backend): printf-style format strings for tainted-log call sites

CodeQL's js/tainted-format-string rule flags template literals in the first
arg of console.X when any interpolated value is user-controlled, regardless
of whether each value is sanitized inline. The canonical mitigation is to
use a static format string and pass values as positional args.

Converts the 28 flagged template literals to printf-style ("%s") format
strings, with sanitizeForLog applied to each positional arg. Also fills in
the log-injection wraps on 9 sites where a user-controlled value was
missed in the first sweep (agents, fleet, gitSources, imageUpdates,
GitSourceService).

No behavior change at runtime. Node's util.format substitutes %s tokens
identically to template-literal interpolation.

* fix(backend): wrap nodeId/snapshotId in fleet restore debug log

CodeQL flagged the unwrapped numeric args even though they cannot
contain control chars in practice. Apply the sanitizer for taint-flow
recognition.

backend/src/utils/safeLog.ts

@@ -0,0 +1,15 @@
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS_REGEX = /[\r\n\t\x00-\x1F\x7F]/g;
+
+/**
+ * Strip CR, LF, tab, and other ASCII control characters from a value before
+ * embedding it in a log line. Prevents log-injection attacks where untrusted
+ * input could forge multi-line log entries or terminal escape sequences.
+ *
+ * Use at every site where a user-controlled string flows into console.log /
+ * console.warn / console.error, including via template literals.
+ */
+export function sanitizeForLog(value: unknown): string {
+  const s = typeof value === 'string' ? value : String(value);
+  return s.replace(CONTROL_CHARS_REGEX, '');
+}

backend/src/utils/validation.ts

@@ -1,4 +1,5 @@
 import path from 'path';
+import { sanitizeForLog } from './safeLog';
 
 /**
  * Stack name must only contain URL-safe characters with no path separators.
@@ -19,7 +20,7 @@ export function isValidRemoteUrl(
   try {
     url = new URL(raw);
   } catch (e) {
-    console.warn('[Validation] URL parse failure:', (e as Error).message, '— input:', raw);
+    console.warn('[Validation] URL parse failure:', sanitizeForLog((e as Error).message), 'input:', sanitizeForLog(raw));
     return {
       valid: false,
       reason: 'API URL must be a valid URL (e.g. https://my-server.example.com:1852)',