port: apply 7 upstream security/robustness patches

Ports from isolated upstream-port branch (base b3c5a4b), verified in
isolation via baseline-vs-port failure-set diff and re-verified live
(195 pass / 0 fail on affected tests):
- redact Discord bot tokens in outbound (router.ts SECRET_PATTERNS)
- block SSRF to private hosts in MoA base URL (moa.ts)
- refuse public dashboard bind without auth token (web-dashboard-server.ts)
- merge upstream .gitignore rules for python/build/secret noise
- real CPU utilization from /proc/stat instead of load avg (unified-dashboard.ts)
- width-safe placeholder for missing usage window on mobile (unified-dashboard.ts)
- bump direct deps to patch known vulnerabilities (discord.js/yaml/cron-parser)

Risky upstream commits (d5a94af phantom reset-time, patch 6 Codex usage)
intentionally skipped to avoid touching the credential-isolation tree.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/router.ts

@@ -42,6 +42,8 @@ const SECRET_PATTERNS: RegExp[] = [
   /glpat-[A-Za-z0-9_-]{20,}/g, // GitLab PAT
   /AKIA[A-Z0-9]{16}/g, // AWS Access Key
   /Bearer\s+eyJ[A-Za-z0-9_-]{40,}/g, // Bearer JWT
+  // Discord bot token: base64 id "." 6-char ts "." 27+ char hmac
+  /\b[MN][A-Za-z0-9_-]{23,}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,}\b/g,
 ];
 
 function redactSecrets(text: string): string {