Fix 8 code-review findings: security + reliability

1. agent.py: shell allow-check reads cfg, not server payload (RCE fix)
2. webhook.php: move WEBHOOK_SECRET to gitignored config.php; rotate secret
3. agent.py: replace recursive main() with while loop (RecursionError fix)
4. jarvis-deploy.sh: push force-revert to GitHub on syntax fail (loop fix)
5. agent.py: self_update() verifies SHA-256 before exec (integrity fix)
6. agent.php: remove JARVIS_IP from browser-action bypass (auth fix)
7. jarvis-watchdog.sh: escape SQL vars in alert() to prevent injection
8. jarvis-deploy.sh: atomic mv instead of cat+truncate (TOCTOU fix)

Also: distribute jarvis-agent.py.sha256 alongside agent for integrity checks

deploy/jarvis-watchdog.sh

@@ -10,15 +10,23 @@ TS() { date '+%Y-%m-%d %H:%M:%S'; }
 
 log() { echo "[$(TS)] $1" >> "$LOG"; }
 
+# Escape single quotes for MySQL string interpolation in bash
+sql_esc() { printf '%s' "$1" | sed "s/'/\\\\''/g"; }
+
 alert() {
     local type="$1" title="$2" msg="$3" sev="${4:-warning}"
+    local e_type e_title e_msg e_sev
+    e_type=$(sql_esc "$type"); e_title=$(sql_esc "$title")
+    e_msg=$(sql_esc "$msg");   e_sev=$(sql_esc "$sev")
     $MYSQL "INSERT IGNORE INTO alerts (alert_type,title,message,severity,source_key,auto_resolve)
-            VALUES ('$type','$title','$msg','$sev','watchdog:$type',1);" 2>/dev/null
+            VALUES ('$e_type','$e_title','$e_msg','$e_sev','watchdog:$e_type',1);" 2>/dev/null
 }
 
 resolve() {
+    local e_key
+    e_key=$(sql_esc "$1")
     $MYSQL "UPDATE alerts SET resolved=1,resolved_at=NOW()
-            WHERE source_key='watchdog:$1' AND resolved=0;" 2>/dev/null
+            WHERE source_key='watchdog:$e_key' AND resolved=0;" 2>/dev/null
 }
 
 # ── Service health ─────────────────────────────────────────────────────────────