DIR//LISTER v26.0911 — 10/10 hardening pass
==========================================
- STATIC_LOCK_GUARD: Apache deny-all .htaccess inside locked roots
- Downloads via ?api=download (session unlock aware)
- CSP nonce on scripts (no script unsafe-inline)
- ALERT_WEBHOOK / ALERT_EMAIL on lock_fail threshold
- i18n id/en (Ctrl+K language)
- ws-gateway.example.mjs optional WebSocket relay