fix(security): CodeQL findings — email injection, allocation DoS, cookie flags

[JairusSW]

Fixes the first-party CodeQL alerts:

• Email header injection (critical, feat: immutable per-release content hash #7) — email.Send now rejects any to/subject/from containing CR/LF, so a user-supplied recipient can't inject extra SMTP headers.
• Uncontrolled allocation (high, Unify branches: bring publish API + api.pkg.wago.sh config into main #3/chore: match wago.sh branding — logo, favicon, manifest #6) — InstallSeries caps sinceDays at 366 in both the JSON and Pebble stores, so GET …/installs?days=999999999 can't force a huge allocation / loop.
• State-cookie clear (medium, fix(ci): deploy on master + restore cmd/registry entrypoint #4/fix: sign-in button uses real GitHub OAuth (no more mock) #5) — the OAuth wago_oauth_state clear cookie now sets HttpOnly + Secure(prod) + SameSite=Lax via a new ClearStateCookie helper.

build/vet/gofmt clean; both stores compile. (The remaining 4 alerts are js/bad-tag-filter inside the vendored marked library, whose output we always run through DOMPurify — handled separately.)