mbproxy: remediate the 2026-05-16 code-review findings

Fixes every finding from the codereviews/2026-05-16 multi-agent review
(2 Critical, 20 Major, 38 Minor) and adds that review to the repo.

Highlights: dashboard XSS escape; response cache invalidated on the
write request (not just the response); ReloadValidator now runs at
startup so port collisions / duplicate names / malformed Resilience
profiles fail fast; AdminPort 0 genuinely disables the admin endpoint;
PlcListener accept-loop faults propagate to the supervisor's faulted
path; reconciler Restart builds before removing; Resilience pipelines
are restart-only from a frozen snapshot; multiplexer connect-race leak,
watchdog party-list snapshot, backend-response and FC16 framing
validation; frontend reconnect retry and util.js load guard; plus the
log-event/doc drift sweep and test-port hygiene.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

mbproxy/tests/Mbproxy.Tests/Sim/DL205SimulatorFixture.cs

@@ -118,9 +118,12 @@ public sealed class DL205SimulatorFixture : IAsyncLifetime
         _process.BeginErrorReadLine();
 
         // ── 5. Poll for TCP readiness (up to ReadinessTimeout) ───────────────
+        // Link the readiness deadline against the test-runner's cancellation token so a
+        // CI job timeout / keyboard interrupt aborts the poll promptly instead of running
+        // the full 120 s and leaving the spawned Python process orphaned (review M3).
         using var deadline = new CancellationTokenSource(ReadinessTimeout);
         using var linked   = CancellationTokenSource.CreateLinkedTokenSource(
-            deadline.Token, CancellationToken.None);
+            deadline.Token, TestContext.Current.CancellationToken);
 
         bool ready = false;
         while (!linked.Token.IsCancellationRequested)