fix(adhoc-sweep-fixes): CU-86akhf8u4 37 review findings across 27 files

[flamingo]

Closes 37 review findings across 27 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

Warning

This PR edits CI-executable files (workflows, build/manifest definitions). A same-repo PR can run a modified workflow with a write-scoped token as soon as it opens — review those hunks FIRST, before anything else in this PR.

#	Fix confidence	Finding	Location
1	🟡 70 medium	obj.getWebServerName referenced but never defined / domain and req are undefined in scope	meshscanner.js:165
2	🟢 95 high	Unwrapped ws.send()-style server4.send() call in sendPendingPacket has no try/catch	meshscanner.js:245
3	🟢 95 high	amt-redir-duk.js: case 0x41 calls obj.amtaccumulator.substring which is not a Buffer method	agents/modules_meshcmd/amt-redir-duk.js:227
4	🟡 70 medium	agents/modules_meshcmd/amt-redir-duk.js missing jshint header / 'use strict'	agents/modules_meshcmd/amt-redir-duk.js:1
5	🟢 95 high	crowdsec.js: applyCaptcha imported but never used; unused import shadows real captcha middleware	crowdsec.js:7
6	🟡 70 medium	crowdsec.js generateCaptcha() referenced before ip entry exists causes crash on first captcha render	crowdsec.js:91
7	🟢 100 high	Stray identifier f after require call causes a syntax/runtime error in pkcs7-modified.js	pkcs7-modified.js:20
8	🟡 85 medium	Value-clamping fix in SingleType.writeValue silently corrupts negative or out-of-range wire values instead of raising a protocol error	rdp/core/type.js:305
9	🟢 90 high	ModernModal.show() builds unused modalContent HTML string that is discarded	public/js/ui-components.js:31
10	🟡 70 medium	showModal() called with modalId lacking the 'Modal' suffix in ModernModal.show(), inconsistent with openModal() helper	public/js/ui-components.js:55
11	🔴 45 low — review closely	IconUploadComponent registers itself in a global map with no cleanup/unregister path	public/js/ui-components.js:240
12	🟢 90 high	readLastBlock reads Time field from wrong buffer (buf instead of buf2)	mcrec.js:236
13	🟢 90 high	readLastBlock uses undeclared global variable extraMetadata	mcrec.js:230
14	🟡 80 medium	NegotiationFailureCode used but never defined/imported in x224.js	rdp/protocol/x224.js:312
15	🔴 55 low — review closely	X224 client emits plain string as error object instead of Error-like object with util.inherits pattern	rdp/protocol/x224.js:230
16	🟡 70 medium	wifi-scanner.js linux scan handler references undeclared 'tokens' and 'this.buffer' instead of the accumulated MemoryStream data	agents/modules_meshcore/wifi-scanner.js:81
17	🟡 60 medium	wifi-scanner.js linux path reads child.stdout without initializing/accumulating a .str property per convention	agents/modules_meshcore/wifi-scanner.js:75
18	🟡 85 medium	linux_cpuUtilization can produce NaN/Infinity on first call due to uninitialized cpuLastIdle/cpuLastSum	agents/modules_meshcore/sysinfo.js:109
19	🟢 90 high	macos_memUtilization throws a plain string instead of an Error object	agents/modules_meshcore/sysinfo.js:223
20	🟢 92 high	Prometheus metrics endpoint reports ConnectedIntelAMTCira=undefined when parent.mpsserver is null	monitoring.js:71
21	🟢 98 high	Stray leftover comment fragment '30bb4fb74dfb758d36be52a7' in gaugeMetrics definition	monitoring.js:42
22	🟢 90 high	public/samples/relay.js: onStateChanged called without obj. prefix — ReferenceError if invoked	public/samples/relay.js:22
23	🟢 95 high	RA2Cipher.setKey passes malformed usages array "encrypt, decrypt" instead of two separate strings	public/novnc/core/ra2.js:11
24	🟢 98 high	Duplicate UpdateType object literal declared twice in the same file	rdp/protocol/pdu/data.js:121
25	🟢 97 high	MCS.recv() uses undeclared global variable opcode (missing var)	rdp/protocol/t125/mcs.js:200
26	🟡 80 medium	agents/hashagents.js references getSHA384FileHash but never defines or imports it	agents/hashagents.js:33
27	🟡 75 medium	amt-xml.js _PutObjToBodyXml references undeclared global obj instead of a local/module reference	agents/modules_meshcmd/amt-xml.js:73
28	🟢 92 high	monitor-border.js redInterval and timeouts never cleared/nulled consistently on Stop leaking timers	agents/modules_meshcore/monitor-border.js:45
29	🟢 90 high	Global object leakage via undeclared loop variable 'i' in amt-wsman-ws-0.2.0.js	public/scripts/amt-wsman-ws-0.2.0.js:128
30	🟢 95 high	redirserver.js RootName cert extraction bug: end-index computed but not applied to substring	redirserver.js:63
31	🟡 75 medium	discordFindUserByTag has no callback invocation if no matching user is found across any guild	meshmessaging.js:296
32	🟡 80 medium	Swallowed close/error events in Cliprdr client leave connection issues invisible	rdp/protocol/pdu/cliprdr.js:39
33	🔴 55 low — review closely	agents/meshinstall-linux.sh interpolates unsanitized meshid/url query params directly into wget/curl URLs	agents/meshinstall-linux.sh:141
34	🟢 90 high	ParseWsman swallows all parse errors and logs the raw XML string to console.log	public/scripts/amt-wsman-0.2.0.js:126
35	🔴 45 low — review closely	sync-upstream.yml force-pushes over any manual edits to the sync branch without checking for divergence beyond conflicts	.github/workflows/sync-upstream.yml:40
36	🔴 25 low — review closely	Credentials (username/password) sent in plaintext JSON over WebSocket to mstscrelay	public/scripts/agent-rdp-0.0.1.js:46
37	🔴 45 low — review closely	changes.yaml component filter list only covers 'meshcentral' and 'helm', silently ignoring other repo areas	.github/workflows/changes.yaml:47

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: a05149ef-c4b4-48a6-a445-70f3e3fde4b4

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akhf8u4 MeshCentral review findings sweep (3 PRs)