fix(server): gate --force by --allow-delete and secure root super default

C2: --force is deletion authority (an incoming regular file may remove a
non-empty destination directory tree, and --delete-missing-args may
remove a non-empty directory mirror), but it was not masked by the
operator --allow-delete policy.  The handler now clears
config->force_delete unless --allow-delete was given, exactly like
--delete and --delete-missing-args.

C3: a standalone TCP / --stdio server running as root defaulted to
SUPER_MODE_AUTO, so an untrusted client --devices/--write-devices/
--super could make it create device nodes, write raw devices, or apply
client-chosen ownership.  A privileged standalone receiver now forces
SUPER_MODE_OFF unless the operator opts in with the new server-only
--allow-super flag.  Non-root receivers are unchanged, and the daemon
path keeps its per-module `client owner = yes` gate.  --allow-super is
rejected with --no-super or --daemon.

C6: tls_client_identity_allowed now rejects a CN whose reported length
reached the buffer bound, so a truncated over-long CN cannot be matched
by a required --client-cn prefix.

Tests: an integration regression proving --force cannot replace a
destination directory without --allow-delete; standalone-default tests
for --copy-as refusal and (root-only) skipped device creation; a CLI
unit test for the new flag.  The integration shared_server fixture opts
in with --allow-super so the existing root-only ownership/device/copy-as
tests continue to exercise the opted-in configuration.  README and
RSYNC_COMPAT document the flag and the force/delete gating.

src/server/server_cli.h

@@ -45,6 +45,14 @@ typedef struct ServerCliOptions {
    * device-node creation) even when running as root.  Applies to --stdio and
    * --daemon alike; also makes the server refuse any client --copy-as. */
   bool no_super; /* --no-super */
+  /* --allow-super: standalone/--stdio only opt-in that keeps the historical
+   * permissive behavior for a PRIVILEGED (root) receiver.  Without it a root
+   * standalone server forces SUPER_MODE_OFF, so a client --devices /
+   * --write-devices / --super / ownership request cannot make it create device
+   * nodes, write raw devices, or apply client-chosen ownership.  Non-root
+   * receivers are unaffected (the kernel refuses the confined attempts).  The
+   * daemon path instead uses the per-module `client owner = yes` opt-in. */
+  bool allow_super; /* --allow-super */
   /* --iconv=CONVERT_SPEC: the server's own LOCAL charset declaration.  The
    * client's full spec rides the wire config frame anyway; when the server is
    * started with its own --iconv, its LOCAL half overrides the local charset