mbproxy: remediate the 2026-05-16 code-review findings

Fixes every finding from the codereviews/2026-05-16 multi-agent review
(2 Critical, 20 Major, 38 Minor) and adds that review to the repo.

Highlights: dashboard XSS escape; response cache invalidated on the
write request (not just the response); ReloadValidator now runs at
startup so port collisions / duplicate names / malformed Resilience
profiles fail fast; AdminPort 0 genuinely disables the admin endpoint;
PlcListener accept-loop faults propagate to the supervisor's faulted
path; reconciler Restart builds before removing; Resilience pipelines
are restart-only from a frozen snapshot; multiplexer connect-race leak,
watchdog party-list snapshot, backend-response and FC16 framing
validation; frontend reconnect retry and util.js load guard; plus the
log-event/doc drift sweep and test-port hygiene.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

mbproxy/tests/Mbproxy.Tests/Admin/SignalRFakes.cs

@@ -24,11 +24,10 @@ internal sealed class FakeHubCallerContext : HubCallerContext
     public override void Abort() { }
 }
 
-/// <summary>Records every group join/leave so tests can assert membership changes.</summary>
+/// <summary>Records every group join so tests can assert membership changes.</summary>
 internal sealed class FakeGroupManager : IGroupManager
 {
     public List<(string ConnectionId, string Group)> Added { get; } = [];
-    public List<(string ConnectionId, string Group)> Removed { get; } = [];
 
     public Task AddToGroupAsync(string connectionId, string groupName, CancellationToken cancellationToken = default)
     {
@@ -36,11 +35,10 @@ internal sealed class FakeGroupManager : IGroupManager
         return Task.CompletedTask;
     }
 
+    // StatusHub.OnDisconnectedAsync never calls RemoveFromGroupAsync — SignalR removes a
+    // disconnected connection from its groups implicitly. Nothing to record here.
     public Task RemoveFromGroupAsync(string connectionId, string groupName, CancellationToken cancellationToken = default)
-    {
-        Removed.Add((connectionId, groupName));
-        return Task.CompletedTask;
-    }
+        => Task.CompletedTask;
 }
 
 /// <summary>Records every push so <see cref="StatusBroadcaster"/> tests can assert routing.</summary>