fix: prevent shell injection in update script and avoid nil panic in SNI handler

[fr4iser90]

This PR addresses two small but relevant robustness and security issues:

1. frontend/update-shadcn.cjs

   • Replaced execSync with execFileSync to avoid shell string interpolation
   • Added basic validation for component names (^[a-z0-9_-]+$)

   This removes potential command injection vectors and aligns with safer process execution practices.

2. portal/server.go

   • Added a nil-check before closing wrappedConn in the error path of handleSNIConn
   • Falls back to closing the original connection if wrapping failed

   This prevents a possible nil dereference panic during connection handling.

Both changes are minimal, backward-compatible, and do not alter intended behavior.

[gosunuts]

LGTM