FaceZio Security Patch v1

Code-only hardening. This patch does not change .env, the database, user uploads,
branding, plans, tenants, contacts, templates, campaigns, queues, cron schedules,
payment settings, or WhatsApp credentials.

Patched areas:
- admin-only database upgrade endpoints
- admin-only module management
- safe module ZIP extraction (path traversal/symlink rejection)
- admin-only email management
- admin-only ticket management
- Meta X-Hub-Signature-256 webhook verification
- SSRF blocking for tenant outbound webhook destinations
- removed eval() from settings navigation conditions
- safe conditional System Information navigation
- removed a stale CSRF exception

No database migration is required for this patch.
