Fix review findings: upload safety, job concurrency, and filtering

[Neo23x0]

Summary

• harden upload handling against path traversal by sanitizing names and constraining writes to the job directory
• avoid unsafe concurrent reads of mutable jobs by returning cloned snapshots from read endpoints
• populate job strings from generation output so rule-name suggestion uses real high-scoring strings
• fix wide-string goodware matching by checking prefixed and unprefixed keys
• ensure goodware databases are loaded/reloaded when opcode analysis is enabled after prior non-opcode runs

Validation

• go test ./...
• go vet ./...