fix: security hardening — bind, validation, atomic writes, deploy rollback

[paralizeer]

Summary

Security and reliability improvements based on a thorough code review. All changes are backwards-compatible and all 127 existing tests pass.

• Default bind 127.0.0.1 — server, install.sh, and config.yaml all defaulted to 0.0.0.0, exposing the unauthenticated dashboard to the entire network. Changed to localhost-only; users who need network access can explicitly set host: 0.0.0.0 in config
• Agent name validation — added ^[a-z0-9][a-z0-9-]{0,62}$ regex check on create and deploy endpoints, preventing malformed names from reaching incus CLI
• Framework allowlist — deploy endpoint now rejects unknown frameworks instead of pip install-ing arbitrary user input inside containers
• Atomic config writes — save_config() now writes to .yaml.tmp then renames, preventing corruption if the process crashes mid-write
• Deploy rollback — if any step fails after container creation, the container is automatically destroyed instead of being left half-configured
• QMD serve hardening — added NoNewPrivileges=true to the systemd unit template
• Removed hardcoded IPs — Tailscale IPs and LAN addresses removed from committed data/config.yaml

Test plan

• All 127 existing tests pass (pytest tests/ -v)
• Manual test: deploy an agent with an invalid name → should get 400
• Manual test: deploy with framework: "malicious-package" → should get 400
• Manual test: verify server only listens on localhost after fresh install

🤖 Generated with Claude Code

[jaylfc]

Thanks for the thorough review and solid PR @paralizeer. I've cherry-picked the security fixes I wanted and committed them in 824f8cf.

Merged (with credit):

• ✅ Atomic config writes — write to .yaml.tmp then rename. Clean and prevents corruption.
• ✅ Agent name validation — the regex check is important since names go into incus CLI commands.
• ✅ Deploy rollback — try/except with container cleanup on failure. No more orphaned containers.
• ✅ NoNewPrivileges=true on the qmd serve systemd unit inside containers.
• ✅ QMD serve binds 0.0.0.0 inside container — correct, the host needs to reach it.
• ✅ Removed hardcoded IPs — good catch, these should never have been committed. I've also moved config.yaml to config.yaml.example and gitignored the actual config along with hardware.json and installed.json.

Not merged (with reasoning):

• ❌ Default bind 127.0.0.1 — TinyAgentOS is designed to run on LAN devices (SBCs, home servers) where users access the dashboard from another machine on the network. Binding to localhost would break this for most users out of the box. Since there's no auth yet (trusted LAN assumption), the UX tradeoff favours accessibility. Auth is on the roadmap and will address this properly.
• ❌ Hardcoded framework allowlist — instead I validate against the app catalog registry dynamically. This means new frameworks added to the catalog are automatically allowed without code changes.

Closing this PR since the relevant changes have been applied. Appreciate the contribution — the atomic writes and deploy rollback in particular are the kind of reliability fixes that matter on embedded hardware where crashes happen.