fix(sentinel): add token validation to prevent command injection

Add validation to ensure sentinel tokens contain only safe characters
(alphanumeric, dots, hyphens, underscores, plus, forward slash, equals),
preventing OS command injection vulnerabilities when tokens are
interpolated into shell commands.

- Add ServerSetting::isValidSentinelToken() validation method
- Validate tokens in StartSentinel action and metrics queries
- Improve shell argument escaping with escapeshellarg()
- Add comprehensive test coverage for token validation

app/Livewire/Server/Sentinel.php

@@ -19,7 +19,7 @@ class Sentinel extends Component
 
     public bool $isMetricsEnabled;
 
-    #[Validate(['required'])]
+    #[Validate(['required', 'string', 'max:500', 'regex:/\A[a-zA-Z0-9._\-+=\/]+\z/'])]
     public string $sentinelToken;
 
     public ?string $sentinelUpdatedAt = null;