fix: harden input validation, authentication, and P2P broadcast verification

[Cabecinha84]

Summary

A collection of security hardening fixes across several FluxOS subsystems:

• Validate IP against confirmed fluxnode list before availability check — Ensure the target ip:port is
  a confirmed node on the network before making any outbound HTTP requests in isFluxAvailable, preventing
  SSRF-style abuse.
• Use Number.isFinite for syncthing random string length validation — Replace unary + operator
  with Number.isFinite() to prevent NaN bypass of the length limit check in getSvcRandomString.
• Add authentication to syncthing events endpoints — Add verifyPrivilege('adminandfluxteam') checks
  to getEvents and getEventsDisk to prevent unauthenticated access to syncthing event data.
• Verify sender pubkey matches target node in P2P broadcast messages — Cross-reference the sender's
  public key against the node at the target IP in verifyFluxBroadcast, ensuring node operators can only
  broadcast messages about their own IP address.

Files changed

• ZelBack/src/services/fluxCommunicationUtils.js
• ZelBack/src/services/fluxNetworkHelper.js
• ZelBack/src/services/syncthingService.js

[MorningLightMountain713]

Ack