fix: header injection, api timeout, nginx duplicate + bump 0.5.21

- server.js: санитизация filename в /export (header injection)
- ui/api-client.js: req.setTimeout(15000) + try/catch JSON.parse
- docs/devops-deploy.md: убран дубль X-Forwarded-Proto

ui/api-client.js

@@ -48,12 +48,16 @@ function apiRequest(method, path, token, body) {
       res.on('data', c => { raw += c; });
       res.on('end', () => {
         const ct = res.headers['content-type'] || '';
-        const data = ct.includes('application/json') ? JSON.parse(raw) : raw;
-        resolve({ status: res.statusCode, data });
+        try {
+          const data = ct.includes('application/json') ? JSON.parse(raw) : raw;
+          resolve({ status: res.statusCode, data });
+        } catch (e) {
+          reject(new Error('Invalid JSON from API: ' + e.message));
+        }
       });
     });
+    req.setTimeout(15000, () => { req.destroy(); reject(new Error('API timeout')); });
     req.on('error', reject);
-    req.on('timeout', () => { req.destroy(); reject(new Error('API timeout')); });
     if (bodyStr) req.write(bodyStr);
     req.end();
   });