fix: correct audit event names, attachment deletion, redirect safety, and add account deactivation check

- Fix audit event names in CLI prune/clear commands from `cli.seo.*` to `cli.seo_meta.*`
- Refactor `_delete_attachment_file` to accept full attachment dict instead of storage_path string, using directory and stored_name fields with ATTACHMENTS_DIR
- Add `safe_next` validation for referer header in validation error redirect and media redirect
- Add `is_active` check in login router to reject deactivated accounts with "Account is deactivated" error
- Replace raw `request.headers.get("Referer")` with `redirect_back()` utility in bookmarks, polls, reactions, and votes routers
- Move `mark_conversation_read` call from `get_conversation_messages` to `messages_page` to avoid side effects during message retrieval
- Fix poll audit link to use `option.get("label")` instead of `option.get("text")`
- Add `VOTABLE` set validation in votes router to reject invalid target types with 400 response
- Strip control characters (0x00-0x20) from URLs in `_safe_url` instead of simple strip
- Add `__getattr__` fallback in services `__init__.py` for dynamic attribute access

devplacepy/services/xmlrpc/server.py

@@ -6,7 +6,11 @@ import logging
 from socketserver import ForkingMixIn
 from xmlrpc.server import SimpleXMLRPCDispatcher, SimpleXMLRPCRequestHandler, SimpleXMLRPCServer
 
+from defusedxml.xmlrpc import monkey_patch as _harden_xmlrpc
+
 from devplacepy.config import XMLRPC_BIND, XMLRPC_PORT
+
+_harden_xmlrpc()
 from . import bridge
 from .registry import Method, build_index, method_help, method_signature
 
@@ -42,6 +46,11 @@ class _RequestHandler(SimpleXMLRPCRequestHandler):
     rpc_paths = RPC_PATHS
 
     def decode_request_content(self, data):
+        if b"<!DOCTYPE" in data or b"<!ENTITY" in data:
+            self.send_response(400)
+            self.send_header("Content-length", "0")
+            self.end_headers()
+            return None
         self.server.current_auth = _auth_from_headers(self.headers)
         return super().decode_request_content(data)