fix: harden security, eliminate panics, remove dead code, add Dockerfile

Security:
- Use constant-time password comparison (subtle crate) to prevent timing attacks
- Replace permissive CORS with configurable origin-restricted CORS
- Add TLS warning when password auth is used without HTTPS

Bug fixes:
- Convert MetaPlugin panics to anyhow::Result (get_meta_plugin, outputs_mut, options_mut)
- Replace item.id.unwrap() with proper error handling across 15 call sites
- Fix panic on unknown column type in list mode
- Fix conflicting PIPESIZE constant (was 8192 vs 65536, now unified to 8192)
- Add 256MB filter chain buffer limit to prevent OOM
- Gracefully skip unregistered plugins instead of panicking

Dead code removal:
- Delete unused filter parser files (filter_parser.rs, filter.pest, parser/ module)
- ~260 lines of dead PEG parser code removed

Code consolidation:
- Add is_content_binary_from_metadata() helper (was duplicated in 4 places)
- Simplify save_item_raw() to delegate to save_item_raw_streaming() (~90 lines removed)

Incomplete features:
- Populate filter_plugins in status output from global registry
- Add FallbackMagicFileMetaPlugin (was referenced but never implemented)
- Document init_plugins() as intentional no-op

Infrastructure:
- Add Dockerfile (static musl binary on scratch, 4.8MB)
- Add .dockerignore
- Add cors_origin to ServerConfig and config.rs

src/modes/list.rs

@@ -8,7 +8,7 @@ use crate::modes::common::ColumnType;
 use crate::modes::common::{OutputFormat, format_size};
 use crate::services::item_service::ItemService;
 use crate::services::types::ItemWithMeta;
-use anyhow::Result;
+use anyhow::{Context, Result};
 use comfy_table::CellAlignment;
 use comfy_table::{Attribute, Cell, Color, Row};
 use serde::{Deserialize, Serialize};
@@ -202,7 +202,7 @@ pub fn mode_list(
         let item = item_with_meta.item;
 
         let mut item_path = data_path.clone();
-        item_path.push(item.id.unwrap().to_string());
+        item_path.push(item.id.context("Item missing ID")?.to_string());
 
         let mut table_row = Row::new();
 
@@ -210,7 +210,7 @@ pub fn mode_list(
             let column_type = column
                 .name
                 .parse::<ColumnType>()
-                .unwrap_or_else(|_| panic!("Unknown column {:?}", column.name));
+                .with_context(|| format!("Unknown column type {:?} in list format", column.name))?;
 
             let mut meta_name: Option<&str> = None;
 
@@ -343,7 +343,7 @@ fn show_list_structured(
         let tags: Vec<String> = item_with_meta.tags.iter().map(|t| t.name.clone()).collect();
         let meta = item_with_meta.meta_as_map();
         let item = item_with_meta.item;
-        let item_id = item.id.unwrap();
+        let item_id = item.id.context("Item missing ID")?;
 
         let mut item_path = data_path.clone();
         item_path.push(item_id.to_string());