[matteius]

Producer redirects and config-file streams could bypass source validation, and FFmpeg commands were assembled as text before execution. Apply validation at configuration load, registration, and every producer dispatch; launch FFmpeg through a separate argument-vector path with validated source parameters. Require credentials for config, restart, and exit endpoints even on loopback, disabling them when credentials are absent. Bind the API to loopback by default.

Compatibility: raw FFmpeg command fragments, local file/device inputs, and arbitrary filter/query parameters are rejected. Supported network sources, stream references, codec presets, and validated synthetic test patterns remain available. This branch also preserves the HTTP input-framerate commit already pinned by LightNVR but not yet merged into dev.

Validation:

• Race-enabled tests pass for streams, API authentication, FFmpeg argument vectors, and shell command construction; focused FFmpeg security tests pass.
• Rebuilt-binary HTTP checks verify administrative authentication, unsafe config/source rejection, and working MJPEG pipe and H.264 RTSP snapshots.
• Non-root runtime smoke test verifies transcoding with LightNVR's generated codec templates.
• The broader FFmpeg suite has the same failures as the untouched pinned baseline (existing codec expectations and platform-dependent device expectations).

Companion PR: opensensor/lightNVR#668 updates the submodule pin, container defaults, browser routing, and authenticated reverse-proxy documentation. Merge this PR first; the LightNVR PR pins commit 41c9dfd38c513d73a8265259dcda19a1932f6174, so retain that commit in the merge history or update the companion pin after merging.