test: 20 security tests for audit remediation

- server-auth: verify token removed from /health, auth on /refs, /activity/*
- cookie-picker: auth required on data routes, HTML page unauthenticated
- path-validation: symlink bypass blocked, realpathSync failure throws
- gstack-config: regex key rejected, sed special chars preserved
- state-ttl: savedAt timestamp, 7-day TTL warning
- telemetry: branch/repo with quotes don't corrupt JSON
- adversarial: sidepanel escapes entry.command, freeze prefix collision

browse/test/gstack-config.test.ts

@@ -122,4 +122,17 @@ describe('gstack-config', () => {
     expect(exitCode).toBe(1);
     expect(stdout).toContain('Usage');
   });
+
+  // ─── security: input validation ─────────────────────────
+  test('set rejects key with regex metacharacters', () => {
+    const { exitCode, stderr } = run(['set', '.*', 'value']);
+    expect(exitCode).toBe(1);
+    expect(stderr).toContain('alphanumeric');
+  });
+
+  test('set preserves value with sed special chars', () => {
+    run(['set', 'test_special', 'a/b&c\\d']);
+    const { stdout } = run(['get', 'test_special']);
+    expect(stdout).toBe('a/b&c\\d');
+  });
 });