fix(backend): add path validation to DeleteMod and improve GetLog security

- DeleteMod now validates path prefix against SERVERFILE_DIR and MODS_DIR
  before allowing deletion (prevents arbitrary directory deletion)
- GetLog uses strings.ContainsAny for cross-platform path traversal check

backend/internal/api/mods.go

@@ -2,6 +2,8 @@ package api
 
 import (
 	"net/http"
+	"path/filepath"
+	"strings"
 
 	"arma3-web-server/internal/services"
 
@@ -54,7 +56,18 @@ func (h *Handler) DeleteMod(c *gin.Context) {
 		return
 	}
 
-	if err := services.RemoveMod(input.Path); err != nil {
+	absPath, err := filepath.Abs(input.Path)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
+		return
+	}
+
+	if !strings.HasPrefix(absPath, h.serverfileDir) && !strings.HasPrefix(absPath, h.modsDir) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "path outside allowed directories"})
+		return
+	}
+
+	if err := services.RemoveMod(absPath); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}