Arbitrary disclosure and deletion via stack-name traversal

Path traversal in Dockge 1.5.0 and earlier allows remote authenticated users to read .env or Compose files and delete directories via stack names. Stack.getStack() and the Stack.path getter join stacksDir with an unvalidated name, while docker-socket-handler.ts checks only that stackName is a string before passing it to read, control, and delete paths. Any authenticated user can traverse outside the managed stacks directory to disclose secrets from .env or accepted Compose filenames; deletion succeeds only when the target directory contains a valid Compose file, and instances with disableAuth expose the same operations without authentication.