Merge branch 'fix/audit-remediations' into dev

Every fix on this branch already reached dev through the port in bcee4bf
("apply audit remediations to dev"), adapted to dev's code and in several
places hardened further (0600-at-open xmrig config, strict 127.0.0.0/8
loopback check, metadata cap centralised in httpGetString). F14-1 and F8-2
were fixed independently on dev. All 10 conflicting files therefore resolve
to dev's side, which drops nothing.

The one thing dev lacked is the F14-1 regression test: a quoted empty
console argument ("") must be kept rather than shifting later positional
RPC params. This merge brings that test in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_phase4.cpp

@@ -5573,6 +5573,12 @@ void testConsoleInputModel()
     auto args = dragonx::ui::ParseConsoleCommandArgs("z_sendmany \"from addr\" [{\"address\":\"zs\",\"amount\":1.25}] true");
     EXPECT_EQ(args.size(), static_cast<size_t>(4));
     EXPECT_EQ(args[1], std::string("from addr"));
+    // An explicitly-quoted empty argument must be preserved (not dropped), otherwise
+    // later positional RPC params silently shift by one (F14-1).
+    auto emptyArgs = dragonx::ui::ParseConsoleCommandArgs("walletpassphrase \"\" 60");
+    EXPECT_EQ(emptyArgs.size(), static_cast<size_t>(3));
+    EXPECT_EQ(emptyArgs[1], std::string(""));
+    EXPECT_EQ(emptyArgs[2], std::string("60"));
     auto call = dragonx::ui::BuildConsoleRpcCall("setgenerate true 4");
     EXPECT_TRUE(call.valid);
     EXPECT_EQ(call.method, std::string("setgenerate"));