fix(netflow): reject zero-length template fields to stop decoder DoS (v0.17.6-beta)

A NetFlow v9/IPFIX template declaring a field of length 0 produced a template
with minLength 0. parseDataSet's loop condition (off + minLength <= setEnd) then
stayed true while the field pass advanced `off` by 0 — an infinite loop.

Impact: the collector socket is UDP and unauthenticated, so any host able to
reach the NetFlow port could hang the entire backend with a single 36-byte
packet — Node is single-threaded, so the event loop never yields again and the
API, poller, sockets and health checks all stop. Only reachable while NetFlow is
enabled (off by default).

Two layers of defense in decoder.ts:
- parseTemplates rejects any field with length 0 (meaningless in v9/IPFIX) and
  refuses to cache a template whose computed minLength is 0.
- parseDataSet asserts forward progress: if a full field pass consumes no bytes,
  break instead of spinning. Guards any future zero-width path.

Adds 5 regression tests covering the hang case, a zero-length field among valid
ones, a variable-length field whose length byte is 0, absurd/truncated field
lengths, and that valid v9/IPFIX traffic still decodes afterwards.

Verified: the exact packet that previously hung the process now returns
immediately with no template cached; 20 attack packets fired at the live
collector left the backend healthy and serving, and real exporter flows kept
decoding (102 -> 152 flows across the test). 119 backend tests pass.

Found via an adversarial review; the report identified the infinite loop but
attributed it to the variable-length branch, which provably terminates.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikrotik-manager-backend",
-  "version": "0.17.5-beta",
+  "version": "0.17.6-beta",
   "description": "Mikrotik Network Management Platform - Backend API",
   "main": "dist/index.js",
   "scripts": {