feat: add web dashboard with slide-in drawer navigation

- Flask backend with 23 API routes (entertainment, telegram, docker, system)
- Alpine.js + Tailwind CSS dark-mode SPA with 4 tabs
- pos-dashboard CLI tool with port/config management
- Mobile slide-in drawer with swipe-to-close
- Sticky header stays pinned on scroll
- Tab completion fixes for category-less tools
- POST /api/telegram/commands endpoint for adding commands

lib/config-ui.sh

@@ -180,12 +180,14 @@ cfg_value() {
 # "-" removes the key's line. Same semantics as write_config_key(). Replaces
 # via grep-v + append (not sed), so values may contain &, |, \ etc. safely.
 cfg_write() {
-    local file="$1" key="$2" val="$3" tmp
+    local file="$1" key="$2" val="$3" tmp _esc_key
+    # Escape regex special characters in the key for safe use in grep -v
+    _esc_key="$(printf '%s' "$key" | sed 's/[.[\*^$()+?{|]/\\&/g')"
     mkdir -p "$(dirname "$file")"
     if [ "$val" = "-" ]; then
         [ -f "$file" ] || return 0
         tmp="$(mktemp)"
-        grep -v "^${key}=" "$file" >"$tmp" || true
+        grep -v "^${_esc_key}=" "$file" >"$tmp" || true
         mv "$tmp" "$file"
         chmod 600 "$file"
         return 0
@@ -196,7 +198,7 @@ cfg_write() {
         warn "multi-line paste — using first line only"
     fi
     tmp="$(mktemp)"
-    grep -v "^${key}=" "$file" 2>/dev/null >"$tmp" || true
+    grep -v "^${_esc_key}=" "$file" 2>/dev/null >"$tmp" || true
     printf '%s="%s"\n' "$key" "$val" >>"$tmp"
     mv "$tmp" "$file"
     chmod 600 "$file"