fix: harden auth site access and SSH validation

backend/src/routes/credentialPresets.ts

@@ -3,6 +3,7 @@ import { query, queryOne } from '../config/database';
 import { requireAuth, requireAdmin } from '../middleware/auth';
 import { encrypt } from '../utils/crypto';
 import { rateLimitRedis } from '../middleware/rateLimitRedis';
+import { validateRouterOsUsername } from '../utils/routerOsUsername';
 
 const router = Router();
 router.use(requireAuth);
@@ -106,6 +107,8 @@ router.post('/', requireAdmin, presetMutationLimiter, async (req: Request, res:
       .status(400)
       .json({ error: 'name, api_username, and api_password are required' });
   }
+  const sshUsernameError = validateRouterOsUsername(ssh_username);
+  if (sshUsernameError) return res.status(400).json({ error: sshUsernameError });
 
   const existing = await queryOne<{ id: number }>(
     `SELECT id FROM credential_presets WHERE name = $1`,
@@ -184,6 +187,8 @@ router.put('/:id', requireAdmin, presetMutationLimiter, async (req: Request, res
     );
     if (clash) return res.status(409).json({ error: 'A preset with this name already exists' });
   }
+  const sshUsernameError = validateRouterOsUsername(ssh_username);
+  if (sshUsernameError) return res.status(400).json({ error: sshUsernameError });
 
   const newApiPass = api_password ? encrypt(api_password) : existing.api_password_encrypted;
   let newSshPass: string | null = existing.ssh_password_encrypted;