Release dev: SFTP/diagram hardening, run-window Stop, tooling and security fixes

[JE-Chen]

Merge the accumulated dev work into main for the next stable release.

Highlights

• Diagram editor / networking: safer diagram-file and CoT-URL handling, refusal reasons shown in the IDE language, and SSRF-validated image downloads.
• SSH / SFTP: host-key policy with fingerprint confirmation, declined host keys reported in the IDE language, SFTP transfers cancellable from the tree menu, SHA-1 algorithms disabled on every connect.
• Run window: a Stop button; text/terminal output escaped and shown as plain text.
• Tools: cURL/HAR import, JWT, diff (keeps the smaller diff), regex, header and hashing tools hardened; JSON shown through view-safe formatting.
• Robustness: worker/GUI thread separation, GUI-thread garbage collection, unsaved-work prompts for tabs and docks, view-safe message boxes.
• i18n, docs and tests: expanded test/test_utils/ coverage, updated architecture docs and update log.

Why

Ships the security hardening, SFTP/diagram improvements and tooling work recorded in docs/updates/2026-09*.md to the stable channel.

[codacy-production]

Not up to standards ⛔

🔴 Issues 5 critical · 6 high

Alerts:
⚠ 11 issues (≤ 0 issues of at least minor severity)

Results:
11 new issues

Category	Results
Security	5 critical 6 high

View in Codacy

🟢 Metrics 1017 complexity · 12 duplication

Metric	Results
Complexity	1017
Duplication	12

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Reliability Rating on New Code (required ≥ A)
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE