fix(server): gate --force by --allow-delete and secure root super default

C2: --force is deletion authority (an incoming regular file may remove a
non-empty destination directory tree, and --delete-missing-args may
remove a non-empty directory mirror), but it was not masked by the
operator --allow-delete policy.  The handler now clears
config->force_delete unless --allow-delete was given, exactly like
--delete and --delete-missing-args.

C3: a standalone TCP / --stdio server running as root defaulted to
SUPER_MODE_AUTO, so an untrusted client --devices/--write-devices/
--super could make it create device nodes, write raw devices, or apply
client-chosen ownership.  A privileged standalone receiver now forces
SUPER_MODE_OFF unless the operator opts in with the new server-only
--allow-super flag.  Non-root receivers are unchanged, and the daemon
path keeps its per-module `client owner = yes` gate.  --allow-super is
rejected with --no-super or --daemon.

C6: tls_client_identity_allowed now rejects a CN whose reported length
reached the buffer bound, so a truncated over-long CN cannot be matched
by a required --client-cn prefix.

Tests: an integration regression proving --force cannot replace a
destination directory without --allow-delete; standalone-default tests
for --copy-as refusal and (root-only) skipped device creation; a CLI
unit test for the new flag.  The integration shared_server fixture opts
in with --allow-super so the existing root-only ownership/device/copy-as
tests continue to exercise the opted-in configuration.  README and
RSYNC_COMPAT document the flag and the force/delete gating.

src/server/server_cli.c

@@ -179,6 +179,8 @@ int server_cli_parse(int argc, char* argv[], ServerCliOptions* opts, char* err,
       opts->trust_sender = true;
     } else if (arg_is(argv[i], "--no-super")) {
       opts->no_super = true;
+    } else if (arg_is(argv[i], "--allow-super")) {
+      opts->allow_super = true;
     } else if (arg_is(argv[i], "--allow-unauthenticated")) {
       opts->allow_unauthenticated = true;
     } else if (arg_has_value(argv[i], "--iconv", &inline_value)) {
@@ -259,6 +261,16 @@ int server_cli_parse(int argc, char* argv[], ServerCliOptions* opts, char* err,
     set_error(err, err_size, "--hash-credentials cannot be combined with --daemon or --stdio");
     return -1;
   }
+  if (opts->allow_super && opts->no_super) {
+    set_error(err, err_size, "--allow-super and --no-super are mutually exclusive");
+    return -1;
+  }
+  if (opts->allow_super && opts->daemon_mode) {
+    set_error(err, err_size,
+              "--allow-super is for a standalone/--stdio server; daemon modules opt in per "
+              "module with 'client owner = yes'");
+    return -1;
+  }
   if (opts->hash_iterations_set && opts->hash_credentials_file == NULL) {
     set_error(err, err_size, "--iterations requires --hash-credentials");
     return -1;