fix: DeepSeek audit — header injection + IAM limit + bump 0.5.22

- src/api/routes/entries.js: санитизация filename в /api/v1/entries/export
- ui/routes/export.js: санитизация filename в UI /export
- src/auth.js: лимит 100KB для IAM-ответов
- src/api/routes/entries.js: fallback для пустого allowedIds

src/auth.js

@@ -297,7 +297,7 @@ async function fetchIamUser(token) {
       headers:  { Authorization: 'Bearer ' + token, Accept: 'application/json' },
     }, (res) => {
       let data = '';
-      res.on('data', c => { data += c; });
+      res.on('data', c => { data += c; if (data.length > 100_000) { req.destroy(); reject(new Error('Response too large')); } });
       res.on('end', () => {
         if (res.statusCode !== 200) {
           return reject(new Error(`IAM API returned ${res.statusCode}: ${data.slice(0, 200)}`));
@@ -351,7 +351,7 @@ async function switchProfile(token, profileId) {
       },
     }, (res) => {
       let data = '';
-      res.on('data', c => { data += c; });
+      res.on('data', c => { data += c; if (data.length > 100_000) { req.destroy(); reject(new Error('Response too large')); } });
       res.on('end', () => {
         if (res.statusCode !== 200) {
           return reject(new Error(`IAM switch-profile failed: ${res.statusCode} ${data.slice(0, 200)}`));