fix(backend): add path validation to DeleteMod and improve GetLog security

- DeleteMod now validates path prefix against SERVERFILE_DIR and MODS_DIR
  before allowing deletion (prevents arbitrary directory deletion)
- GetLog uses strings.ContainsAny for cross-platform path traversal check

backend/internal/api/logs.go

@@ -170,7 +170,7 @@ func findLatestRPT(dir string) string {
 
 func (h *Handler) GetLog(c *gin.Context) {
 	filename := filepath.Base(c.Param("file"))
-	if filename == "" || strings.ContainsRune(c.Param("file"), os.PathSeparator) {
+	if filename == "" || filename == "." || strings.ContainsAny(filename, "/\\") {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid filename"})
 		return
 	}