- BUG7/8 CRITICAL: view_test_rule() used escape_html() as regex escape,
allowing user input injection. Now uses plain string suffix matching.
- BUG9 HIGH: set_tg_state(chat_id, null) ran BEFORE action execution,
so if the action threw an exception the user lost their state context.
Now state is cleared only after successful UCI commit in each branch.
sec_create with invalid name preserves state for retry.
- BUG13 LOW: /set_arr_del and /sec_del_it callback_data could exceed
Telegram's 64-byte limit with long domain names. Added cb_data()
helper that truncates and appends a hash when over limit.
Dushnilin
a32ad76285