refactor(server): replace custom remote clients with macro-based implementation

- Replaced manual remote client functions with remote_client! macro for archive, blame, branch, commit, and diff services
- Simplified remote client creation logic using declarative macro approach
- Maintained same functionality while reducing code duplication across services

security(bare): enhance path traversal protection with comprehensive validation

- Added early relative_path validation to prevent path traversal attacks
- Implemented unified path validation to avoid TOCTOU race conditions
- Enhanced canonicalization checks for both existing and non-existent paths
- Added detailed logging for path traversal detection attempts

feat(cache): migrate from CLruCache to Moka with TTL and invalidation support

- Replaced clru dependency with moka for improved caching capabilities
- Added 300-second time-to-live for cache entries
- Implemented repository-specific cache invalidation mechanism
- Enhanced cache operations with thread-safe async support

refactor(commit): improve security validation for commit operations

- Added ref name validation to prevent command injection in cherry_pick_commit
- Implemented revision validation for commit selectors
- Added comprehensive input validation for create_commit parameters
- Enhanced file path validation to prevent traversal

branch/create_branch.rs

@@ -6,9 +6,13 @@ use crate::pb::{Branch, CreateBranchRequest, GetBranchRequest, object_selector};
 
 impl GitBare {
     pub fn create_branch(&self, request: CreateBranchRequest) -> GitResult<Branch> {
+        crate::sanitize::validate_ref_name(&request.name)?;
         let revision = match request.start_point.and_then(|s| s.selector) {
             Some(object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(object_selector::Selector::Revision(name)) => name.revision,
+            Some(object_selector::Selector::Revision(name)) => {
+                crate::sanitize::validate_revision(&name.revision)?;
+                name.revision
+            }
             None => "HEAD".into(),
         };
         let mut args = vec!["branch".to_string()];

branch/delete_branch.rs

@@ -6,6 +6,7 @@ use crate::pb::DeleteBranchRequest;
 
 impl GitBare {
     pub fn delete_branch(&self, request: DeleteBranchRequest) -> GitResult<()> {
+        crate::sanitize::validate_ref_name(&request.name)?;
         let flag = if request.force { "-D" } else { "-d" };
         let output = Command::new("git")
             .arg("--git-dir")

branch/rename_branch.rs

@@ -6,6 +6,8 @@ use crate::pb::{Branch, GetBranchRequest, RenameBranchRequest};
 
 impl GitBare {
     pub fn rename_branch(&self, request: RenameBranchRequest) -> GitResult<Branch> {
+        crate::sanitize::validate_ref_name(&request.old_name)?;
+        crate::sanitize::validate_ref_name(&request.new_name)?;
         let output = Command::new("git")
             .arg("--git-dir")
             .arg(&self.bare_dir)

branch/set_branch_upstream.rs

@@ -4,6 +4,7 @@ use crate::pb::{Branch, GetBranchRequest, SetBranchUpstreamRequest};
 
 impl GitBare {
     pub fn set_branch_upstream(&self, request: SetBranchUpstreamRequest) -> GitResult<Branch> {
+        crate::sanitize::validate_ref_name(&request.name)?;
         if let Some(upstream) = request.upstream {
             let tracking = format!("{}/{}", upstream.remote_name, upstream.remote_branch_name);
             let result = duct::cmd(

branch/update_branch_target.rs

@@ -7,6 +7,7 @@ use crate::pb::{Branch, GetBranchRequest, UpdateBranchTargetRequest};
 
 impl GitBare {
     pub fn update_branch_target(&self, request: UpdateBranchTargetRequest) -> GitResult<Branch> {
+        crate::sanitize::validate_ref_name(&request.name)?;
         let new_oid = request
             .new_oid
             .as_ref()