security: implement pentest remediation (RATE-002, CLI-001)

RATE-002: Proactive rate limit cleanup when entries exceed threshold
- Add RATE_LIMIT_CLEANUP_THRESHOLD config (default 0.8)
- Trigger cleanup before hitting hard limit
- Prevents memory exhaustion under sustained load

CLI-001: Validate clipboard tool paths against trusted directories
- Add TRUSTED_CLIPBOARD_DIRS for Unix system paths
- Add TRUSTED_WINDOWS_PATTERNS for Windows validation
- Reject tools in user-writable locations (PATH hijack prevention)
- Use absolute paths in subprocess calls

app/config.py

@@ -101,6 +101,10 @@ class Config:
     RATE_LIMIT_AUTH_MULTIPLIER = int(os.environ.get("FLASKPASTE_RATE_AUTH_MULT", "5"))
     # Maximum unique IPs tracked in rate limit storage (RATE-001: memory DoS protection)
     RATE_LIMIT_MAX_ENTRIES = int(os.environ.get("FLASKPASTE_RATE_MAX_ENTRIES", "10000"))
+    # RATE-002: Cleanup threshold (0.0-1.0) - trigger cleanup when entries exceed this ratio
+    RATE_LIMIT_CLEANUP_THRESHOLD = float(
+        os.environ.get("FLASKPASTE_RATE_CLEANUP_THRESHOLD", "0.8")
+    )
 
     # Audit Logging
     # Track security-relevant events (paste creation, deletion, rate limits, etc.)