security: hardening flags + control_server fixes (F-001, F-002)

- Add --hardened flag to build.sh with FORTIFY, stack protector, PIE, RELRO
- Add --enable-hardening to configure.ac
- F-001: fix %s -> %.32s to prevent stack leak from non-null-terminated network string
- F-002: add pre-check recv_len >= MAX before buf_space computation to prevent size_t underflow

src/control_server.c

@@ -479,6 +479,12 @@ static void client_read_callback(socket_t fd, void* arg) {
     struct control_client* client = (struct control_client*)arg;
     struct control_server* server = client->server;
 
+    if (client->recv_len >= ETCPMON_MAX_MSG_SIZE) {
+        DEBUG_ERROR(DEBUG_CATEGORY_CONTROL, "Control recv buffer overflow (pre-check)");
+        close_client(server, client);
+        return;
+    }
+
     /* Read available data */
     uint8_t* buf = client->recv_buffer + client->recv_len;
     size_t buf_space = ETCPMON_MAX_MSG_SIZE - client->recv_len;
@@ -801,7 +807,7 @@ static void handle_client_data(struct control_server* server, struct control_cli
                             u_free(text);
                         }
                     } else {
-                        DEBUG_WARN(DEBUG_CATEGORY_CONTROL, "Unknown action received: '%s'", cmd->action);
+                        DEBUG_WARN(DEBUG_CATEGORY_CONTROL, "Unknown action received: '%.32s'", cmd->action);
                     }
                 }
                 break;