Bug bash fixes: special-file reads, per-client lockout, prefs validation, security headers, kernel-thread guard, login feedback, error text; plus journal-quiet sudoers + journal groups, upload overwrite guard, machines pattern, dnf freshness, cron/services speed, clean version

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

web/src/Files.tsx

@@ -157,9 +157,14 @@ export default function Files({ onOpenInTerminal }: { onOpenInTerminal?: (cmd: s
     const list = Array.from(files)
     for (let i = 0; i < list.length; i++) {
       const f = list[i]
+      let overwrite = false
+      if ((entries ?? []).some((e) => e.name === f.name)) {
+        if (!window.confirm(`"${f.name}" already exists here. Replace it?`)) continue
+        overwrite = true
+      }
       setUpload({ name: f.name, pct: 0, n: i + 1, of: list.length })
       try {
-        await api.fileUpload(path, f, sudo, (pct) => setUpload({ name: f.name, pct, n: i + 1, of: list.length }))
+        await api.fileUpload(path, f, sudo, (pct) => setUpload({ name: f.name, pct, n: i + 1, of: list.length }), overwrite)
       } catch (e) { toast(`upload ${f.name} — ${e instanceof Error ? e.message : 'failed'}`, 'err'); break }
     }
     setUpload(null)