mbproxy: remediate the 2026-05-16 code-review findings

Fixes every finding from the codereviews/2026-05-16 multi-agent review
(2 Critical, 20 Major, 38 Minor) and adds that review to the repo.

Highlights: dashboard XSS escape; response cache invalidated on the
write request (not just the response); ReloadValidator now runs at
startup so port collisions / duplicate names / malformed Resilience
profiles fail fast; AdminPort 0 genuinely disables the admin endpoint;
PlcListener accept-loop faults propagate to the supervisor's faulted
path; reconciler Restart builds before removing; Resilience pipelines
are restart-only from a frozen snapshot; multiplexer connect-race leak,
watchdog party-list snapshot, backend-response and FC16 framing
validation; frontend reconnect retry and util.js load guard; plus the
log-event/doc drift sweep and test-port hygiene.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

mbproxy/install/mbproxy.service

@@ -38,6 +38,9 @@ ProtectSystem=strict
 ProtectHome=true
 PrivateTmp=true
 ReadWritePaths=/var/log/mbproxy /var/cache/mbproxy
+# /etc/mbproxy is intentionally absent from ReadWritePaths: the service only READS its
+# config (ProtectSystem=strict still allows reads), and config changes are an admin
+# operation. Editing appsettings.json must be done as root, not by the service account.
 # If any configured ListenPort is below 1024, also add:
 #   AmbientCapabilities=CAP_NET_BIND_SERVICE
 

mbproxy/install/publish.ps1

@@ -106,7 +106,9 @@ foreach ($flavour in 'self-contained','framework-dependent') {
         $size = (Get-Item $bin).Length
         Write-Host ("  {0,-22} {1,10}  {2}" -f $flavour, (Format-Size $size), $bin)
     } else {
-        Write-Warning "Missing: $bin"
+        # A missing expected binary means the publish silently produced nothing usable —
+        # fail the script rather than emit a warning a CI job would scroll past.
+        throw "Expected published binary not found: $bin"
     }
 }
 Write-Host ""

mbproxy/install/publish.sh

@@ -102,7 +102,10 @@ for flavour in self-contained framework-dependent; do
         size="$(du -h "$bin" | cut -f1)"
         printf '  %-22s %8s  %s\n' "$flavour" "$size" "$bin"
     else
-        echo "  WARNING: missing $bin" >&2
+        # A missing expected binary means the publish silently produced nothing
+        # usable — fail rather than emit a warning a CI job would scroll past.
+        echo "ERROR: expected published binary not found: $bin" >&2
+        exit 1
     fi
 done
 echo