hotfix(wsauth+restart_template): CanvasOrBearer return + CWE-22 path traversal guard

- wsauth_middleware: add missing return after AbortWithStatusJSON in
  CanvasOrBearer final else branch (CRITICAL auth bypass)
- restart_template: apply sanitizeRuntime before filepath.Join to
  prevent CWE-22 path traversal via dbRuntime field

workspace-server/internal/middleware/wsauth_middleware.go

@@ -304,6 +304,7 @@ func CanvasOrBearer(database *sql.DB) gin.HandlerFunc {
 		}
 
 		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "admin auth required"})
+		return
 	}
 }