security: payment-URI amount validation, export filename sanitize, chat crash-guard, HTTPS-only, conf 0600, pool auto-lock

Six bounded defensive fixes:
- Payment-URI amount is now strictly validated (reject NaN/inf/sign/garbage,
  <=8 decimals, 0..21,000,000) at parse time, so a crafted QR/URI can't inject a
  bogus amount into the Send form. The z_sendmany call the user confirms is
  unchanged; this is input validation only.
- export-all-keys filename is sanitized (basename-only, no traversal) via a
  shared util::sanitizeExportFilename (factored out of the CSV export dialog).
- Chat append()/upsert() wrap the strict serialize in try/catch so a malformed
  (invalid-UTF-8, attacker-influenceable) body is skipped, not crashed on —
  matching appendBatch's existing drop behavior.
- http_download (used by the updaters + pool stats) restricts transfers AND
  redirects to HTTPS and bounds the download path's redirects, so a redirect
  can't downgrade to http:// or another scheme.
- The default DRGX.conf (rpcuser/rpcpassword) is written 0600 from the start via
  writeFileAtomically, closing the brief world-readable ofstream+chmod window.
- Auto-lock is suppressed only for SOLO mining (needs the wallet), not pool
  mining (pays an external address), which was holding the wallet open forever.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_phase4.cpp

@@ -1033,7 +1033,17 @@ void testPaymentUri()
 
     auto invalid = dragonx::util::parsePaymentURI("drgx:" + taddr + "?amount=-1");
     EXPECT_FALSE(invalid.valid);
-    EXPECT_EQ(invalid.error, std::string("Invalid negative amount"));
+    EXPECT_EQ(invalid.error, std::string("Invalid amount"));   // strict parse rejects '-' up front now
+
+    // Crafted amounts that std::stod would have accepted are now rejected before the Send form.
+    for (const char* bad : {"nan", "inf", "1e3", "0x10", "1.5abc", "0.000000001", "21000001", ""}) {
+        auto r = dragonx::util::parsePaymentURI("drgx:" + taddr + "?amount=" + bad);
+        EXPECT_FALSE(r.valid);
+    }
+    for (const char* ok : {"1", "0.00000001", "21000000", "1.5"}) {
+        auto r = dragonx::util::parsePaymentURI("drgx:" + taddr + "?amount=" + ok);
+        EXPECT_TRUE(r.valid);
+    }
 }
 
 void testWalletFileProbe()