fix(p8h-core): escape log paths, fail closed on identity activation, tidy server gate

- A6: escape attacker-controlled file paths and the receive root in log
  lines (file_receive, server, protocol DEBUG) with output_escape()
- A8: identity_set_active() returns bool and fails closed when a requested
  usermap/groupmap cannot be deep-copied; handler refuses the connection
- remove the const cast and duplicate super_mode clamp from
  server_module_gate via an explicit override the handler applies once
- release the identity snapshot on the queue_create failure path
- refactor identity_parse_copy_as to a single cleanup tail and drop the
  duplicated group error format specifier

src/shared/identity.h

@@ -67,8 +67,13 @@ bool identity_copy_as_active(void);
 /* Receiver-side snapshot of the negotiated identity config.  The server calls
  * identity_set_active() once per connection (before any file write) using the
  * config received over the wire; the snapshot is a deep copy so the caller may
- * free its Config immediately.  identity_clear_active() releases it. */
-void identity_set_active(const Config* config);
+ * free its Config immediately.  identity_clear_active() releases it.
+ *
+ * Returns true on success.  On an allocation failure while deep-copying a
+ * requested usermap/groupmap it logs a LOG_LEVEL_ERROR, leaves the snapshot
+ * cleared (never a partial/wrong policy) and returns false; the caller must
+ * refuse the connection. */
+bool identity_set_active(const Config* config);
 void identity_clear_active(void);
 
 /* True when any ownership-affecting identity option is present in the active