fix: address critical and high code review findings

- C-1: handle filepath.Abs error in backup path traversal guards
- C-2: WAL checkpoint before live DB restore to prevent corruption
- C-4: default AllowedOrigins to empty (deny cross-origin by default)
- C-5: renumber duplicate 003_ migration prefix (003-008 -> 003-009)
- H-1: sanitize FTS5 query input to prevent operator injection
- H-3: send SIGTERM for graceful shutdown before os.Exit in updater
- H-9: fix RingBuffer memory leak from unbounded backing array growth
- H-10: use errorResponse struct consistently in upload handler

Server/config/config.go

@@ -79,7 +79,7 @@ func defaults() Config {
 			Port:           8443,
 			Name:           "OwnCord Server",
 			DataDir:        "data",
-			AllowedOrigins: []string{"*"},
+			AllowedOrigins: []string{},
 			TrustedProxies: []string{},
 			AdminAllowedCIDRs: []string{
 				"127.0.0.0/8",     // localhost IPv4
@@ -117,7 +117,7 @@ server:
   port: 8443
   name: "OwnCord Server"
   data_dir: "data"
-  # allowed_origins: ["*"]   # restrict WebSocket origins, e.g. ["https://example.com"]
+  # allowed_origins: []       # empty = deny cross-origin; set to ["*"] for dev or specific origins for prod
   # trusted_proxies: []       # CIDRs of trusted reverse proxies, e.g. ["10.0.0.0/8"]
   # admin_allowed_cidrs:      # CIDRs allowed to access /admin (default: private networks only)
   #   - "127.0.0.0/8"