fix(backend): validate telemetry fields; add method guard to /cli/version

- Add platform allowlist validation (windows, darwin, linux) and length caps for version (≤20) and product_id (≤10) in handleTelemetry to prevent unbounded Redis hash growth from attacker-controlled field values.
- Add HTTP method guard to handleCLIVersion to reject non-GET requests with 405 Method Not Allowed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/main.go

@@ -1559,13 +1559,14 @@ func handleTelemetry(w http.ResponseWriter, r *http.Request) {
 		ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond)
 		defer cancel()
 		rdb.HIncrBy(ctx, "msdl:telemetry:actions", p.Action, 1)
-		if p.Platform != "" {
+		validPlatforms := map[string]bool{"windows": true, "darwin": true, "linux": true}
+		if validPlatforms[p.Platform] {
 			rdb.HIncrBy(ctx, "msdl:telemetry:platforms", p.Platform, 1)
 		}
-		if p.Version != "" {
+		if p.Version != "" && len(p.Version) <= 20 {
 			rdb.HIncrBy(ctx, "msdl:telemetry:versions", p.Version, 1)
 		}
-		if p.ProductID != "" {
+		if p.ProductID != "" && len(p.ProductID) <= 10 {
 			rdb.HIncrBy(ctx, "msdl:telemetry:products", p.ProductID, 1)
 		}
 		result := "success"
@@ -1582,6 +1583,10 @@ func handleTelemetry(w http.ResponseWriter, r *http.Request) {
 // --- /cli/version endpoint ---
 
 func handleCLIVersion(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]string{"latest": latestCLIVersion})
 }