fix(security): harden gRPC stream WAF, MCP fs arg validation, and PAT server binding

- ServeRPC now applies real-IP + WAF interceptors to streaming RPCs
  (RequestTask, IOStream), not just unary calls; without them
  authHandler.check saw an empty real IP so brute-force BlockIP counters
  never keyed on a source and the WAF block table was bypassed at the
  stream entrypoint. Factored real-IP resolution into ctxWithRealIP shared
  by unary and stream paths.
- handleFsRead rejects negative offset/length; handleFsWrite validates
  if_match_sha256 is 64 hex chars before dispatch.
- createAPIToken always verifies each server_id exists (even for admins),
  so an admin cannot bind a PAT to a not-yet-created server id that a
  future server would auto-inherit.
- Add relay zero-length-chunk rejection regression test.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

cmd/dashboard/controller/api_token_test.go

@@ -233,6 +233,21 @@ func TestCreateAPIToken_AdminCanIncludeAnyServerID(t *testing.T) {
 	require.Equal(t, []uint64{77}, res.ServerIDs)
 }
 
+func TestCreateAPIToken_AdminCannotIncludeNonexistentServerID(t *testing.T) {
+	defer setupAPITokenTest(t)()
+	defer installServerForAPIToken(t, 77, 999)() // only server 77 exists
+
+	c := ctxAsUser(1, model.RoleAdmin)
+	bindJSON(c, model.APITokenCreateRequest{
+		Name:      "ops-future-bind",
+		Scopes:    []string{model.ScopeServerRead},
+		ServerIDs: []uint64{4242}, // never-existed server id
+	})
+	_, err := createAPIToken(c)
+	require.Error(t, err, "admin must not bind a PAT to a nonexistent server_id; a later-created server with that id would auto-inherit the grant")
+	require.Contains(t, err.Error(), "server not found")
+}
+
 func TestCreateAPIToken_MemberOwnServerIDIsAccepted(t *testing.T) {
 	defer setupAPITokenTest(t)()
 	defer installServerForAPIToken(t, 55, 10)() // user 10 owns server 55