fix(settings): reject spaces, '\' and control chars in URI path settings

webBasePath, subPath, subJsonPath and subClashPath are URL paths, so '/'
stays allowed, but spaces, backslashes and control characters break
routing. Strip them as you type (shared sanitizePath helper, now also
applied to the panel base path) and reject them on save in
AllSetting.CheckValid so direct API callers are covered too.

web/entity/path_validation_test.go

@@ -0,0 +1,32 @@
+package entity
+
+import "testing"
+
+func TestPathHasForbiddenChar(t *testing.T) {
+	valid := []string{
+		"",
+		"/",
+		"/sub/",
+		"/json/",
+		"/a/b/c/",
+		"/My-Path_123/",
+	}
+	for _, p := range valid {
+		if pathHasForbiddenChar(p) {
+			t.Errorf("pathHasForbiddenChar(%q) = true, want false", p)
+		}
+	}
+
+	invalid := []string{
+		"/sub path/",
+		"/back\\slash/",
+		"/tab\there/",
+		"/new\nline/",
+		"/\x7f/",
+	}
+	for _, p := range invalid {
+		if !pathHasForbiddenChar(p) {
+			t.Errorf("pathHasForbiddenChar(%q) = false, want true", p)
+		}
+	}
+}