fix: add input validation to YAML templates, RCON gateway, and match DTOs

[Flegma]

Summary

Three input validation improvements:

1. YAML template sanitization — replacePlaceholders() now strips newlines from replacement values to prevent YAML structure injection. Uses split/join instead of RegExp for safer string replacement.

2. RCON command validation — New validateCommand() method rejects commands that are empty, exceed 512 chars, or contain command-chaining characters (;, \n, \r). All commands are logged for audit trail.

3. Match data DTO validation — Converted MatchData from interface to class with class-validator decorators. Controller now uses @Body() with ValidationPipe({ whitelist: true }) instead of raw req.body cast.

Test plan

• Create offline match via web UI — YAML generated correctly
• RCON commands from admin panel work normally
• Overly long RCON commands (>512 chars) are rejected
• Invalid match data (missing required fields) returns validation error

Closes 5stackgg/5stack-panel#404
Closes 5stackgg/5stack-panel#405
Closes 5stackgg/5stack-panel#406

[lukepolo]

i dont see how this can be anything but a stirng

[Flegma]

Removed the redundant typeof check -- you're right, command will always be a string given the typed parameter.

[Flegma]

Addressed review feedback:

• Removed the redundant typeof command !== "string" check from rcon.gateway.ts -- you're right, command will always be a string given the typed parameter.
• The bot-flagged imports (ValidateNested, Type in MatchData.ts) are actually used by the @ValidateNested() and @Type() decorators on nested properties. The IsOptional import in MatchMap.ts was already removed in a previous commit.