[margani]

Closes #103.

What changed

• temp, rotated-logs, crash-dumps and thumbnails no longer pipe find's list into xargs rm. The listing functions take find actions, and the clean functions pass -execdir rm -f -- {} +, so rm runs on ./name inside the directory find itself walked.
• The report path (sizes) is unchanged: it still uses -print0.

Why

Removing by a path printed earlier re-resolves every directory in it. When run as root over trees other users can write to, a directory replaced in between pointed the delete outside the tree.

Verification

• New case in server/tests/cleanup_test.sh: a first-call rm shim swaps a user's thumbnail directory for a symlink to another directory, and the file there must survive. On the old code: FAIL: a swapped-in symlink redirected the delete out of the cleaned tree; new code: PASS.
• ./run-tests: all 10 passed, 3 skipped.

Not verified

• A real concurrent race as root (the swap is made deterministic with the shim).
• server.ps1's Windows equivalent: it needs a Windows host with junctions. It remains a lead in the audit report.
• clean_temp still removes empty old directories by path with rmdir. rmdir only removes empty directories; noted as hardening.