fix: header injection, api timeout, nginx duplicate + bump 0.5.21

- server.js: санитизация filename в /export (header injection)
- ui/api-client.js: req.setTimeout(15000) + try/catch JSON.parse
- docs/devops-deploy.md: убран дубль X-Forwarded-Proto

server.js

@@ -92,7 +92,7 @@ async function start() {
         const aggregated = aggregateCIDRs(cidrs);
         const text = aggregated.join('\n') + (aggregated.length ? '\n' : '');
         res.set('Content-Type', 'text/plain; charset=utf-8');
-        const fname = req.query.filename || 'white-list.txt';
+        const fname = (req.query.filename || 'white-list.txt').replace(/[^\w\-_. ]/g, '_');
         const disp  = req.query.view === '1' ? 'inline' : 'attachment';
         res.set('Content-Disposition', disp + '; filename="' + fname + '"');
         res.send(text);