Improve security, validation, and isolation checks

Add multiple security and validation improvements across the app:

- Prevent session fixation: regenerate session ID on login and after successful 2FA; tighten session cookie params (Secure, HttpOnly, SameSite=Lax).
- Harden installer: add CSRF checks for install/update flows and use PDO::quote when injecting admin credentials into SQL migration to avoid injection; add csrf_field() to installer templates.
- Template hardening: add safe_url and safe_mailto Twig filters, escape tag names for JS, and add rel="noopener noreferrer" to external links to mitigate XSS/opener risks.
- Domain controller: validate referrer to avoid open redirects, enforce user isolation mode when finding/deleting/updating domains and when assigning notification groups (ensures users only affect their own resources).
- Notification groups: verify channel belongs to group before deleting or toggling to prevent unauthorized access.
- ErrorLog: whitelist allowed sort columns to avoid arbitrary column injection in ORDER BY.
- Routes: move the debug whois route to protected/admin area.

These changes collectively reduce attack surface (XSS, open redirect, session fixation, SQL injection) and enforce proper resource isolation and input validation.

app/Views/domains/bulk-add.twig

@@ -74,7 +74,7 @@
                         <p class="text-xs text-gray-600 dark:text-slate-400 mb-1.5">Available Tags:</p>
                         <div class="flex flex-wrap gap-1.5">
                             {% for tag in availableTags %}
-                                <button type="button" onclick="addTag('{{ tag.name }}')" 
+                                <button type="button" onclick="addTag('{{ tag.name|e('js') }}')" 
                                         class="inline-flex items-center px-2 py-1 rounded-md text-xs font-medium border {{ tag.color }} hover:opacity-80 transition-colors">
                                     <i class="fas fa-plus mr-1" style="font-size: 8px;"></i>
                                     {{ tag.name }}