fix: address 18 CRITICAL+HIGH PR review comments

**Critical Fixes (7 issues):**
- Fix GraphQL schema field names in users tool (role→roles, remove email)
- Fix GraphQL mutation signatures (addUserInput, deleteUser input)
- Fix dict(None) TypeError guards in users tool (use `or {}` pattern)
- Fix FastAPI version constraint (0.116.1→0.115.0)
- Fix WebSocket SSL context handling (support CA bundles, bool, and None)
- Fix critical disk threshold treated as warning (split counters)

**High Priority Fixes (11 issues):**
- Fix Docker update/remove action response field mapping
- Fix path traversal vulnerability in log validation (normalize paths)
- Fix deleteApiKeys validation (check response before success)
- Fix rclone create_remote validation (check response)
- Fix keys input_data type annotation (dict[str, Any])
- Fix VM domain/domains fallback restoration

**Changes by file:**
- unraid_mcp/tools/docker.py: Response field mapping
- unraid_mcp/tools/info.py: Split critical/warning counters
- unraid_mcp/tools/storage.py: Path normalization for traversal protection
- unraid_mcp/tools/users.py: GraphQL schema + null handling
- unraid_mcp/tools/keys.py: Validation + type annotations
- unraid_mcp/tools/rclone.py: Response validation
- unraid_mcp/tools/virtualization.py: Domain fallback
- unraid_mcp/subscriptions/manager.py: SSL context creation
- pyproject.toml: FastAPI version fix
- tests/*: New tests for all fixes

**Review threads resolved:**
PRRT_kwDOO6Hdxs5uu70L, PRRT_kwDOO6Hdxs5uu70O, PRRT_kwDOO6Hdxs5uu70V,
PRRT_kwDOO6Hdxs5uu70e, PRRT_kwDOO6Hdxs5uu70i, PRRT_kwDOO6Hdxs5uu7zn,
PRRT_kwDOO6Hdxs5uu7z_, PRRT_kwDOO6Hdxs5uu7sI, PRRT_kwDOO6Hdxs5uu7sJ,
PRRT_kwDOO6Hdxs5uu7sK, PRRT_kwDOO6Hdxs5uu7Tk, PRRT_kwDOO6Hdxs5uu7Tn,
PRRT_kwDOO6Hdxs5uu7Tr, PRRT_kwDOO6Hdxs5uu7Ts, PRRT_kwDOO6Hdxs5uu7Tu,
PRRT_kwDOO6Hdxs5uu7Tv, PRRT_kwDOO6Hdxs5uu7Tw, PRRT_kwDOO6Hdxs5uu7Tx

All tests passing.

Co-authored-by: docker-fixer <agent@pr-fixes>
Co-authored-by: info-fixer <agent@pr-fixes>
Co-authored-by: storage-fixer <agent@pr-fixes>
Co-authored-by: users-fixer <agent@pr-fixes>
Co-authored-by: config-fixer <agent@pr-fixes>
Co-authored-by: websocket-fixer <agent@pr-fixes>
Co-authored-by: keys-rclone-fixer <agent@pr-fixes>
Co-authored-by: vm-fixer <agent@pr-fixes>

skills/unraid/scripts/unraid-query.sh

@@ -0,0 +1,126 @@
+#!/bin/bash
+# Unraid GraphQL API Query Helper
+# Makes it easy to query the Unraid API from the command line
+
+set -e
+
+# Usage function
+usage() {
+    cat << EOF
+Usage: $0 [OPTIONS]
+
+Query the Unraid GraphQL API
+
+OPTIONS:
+    -u, --url URL          Unraid server URL (required)
+    -k, --key KEY          API key (required)
+    -q, --query QUERY      GraphQL query (required)
+    -f, --format FORMAT    Output format: json (default), raw, pretty
+    -h, --help             Show this help message
+
+ENVIRONMENT VARIABLES:
+    UNRAID_URL             Default Unraid server URL
+    UNRAID_API_KEY         Default API key
+
+EXAMPLES:
+    # Get system status
+    $0 -u https://unraid.local/graphql -k YOUR_KEY -q "{ online }"
+
+    # Use environment variables
+    export UNRAID_URL="https://unraid.local/graphql"
+    export UNRAID_API_KEY="your-api-key"
+    $0 -q "{ metrics { cpu { percentTotal } } }"
+
+    # Pretty print output
+    $0 -q "{ array { state } }" -f pretty
+
+EOF
+    exit 1
+}
+
+# Default values
+URL="${UNRAID_URL:-}"
+API_KEY="${UNRAID_API_KEY:-}"
+QUERY=""
+FORMAT="json"
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -u|--url)
+            URL="$2"
+            shift 2
+            ;;
+        -k|--key)
+            API_KEY="$2"
+            shift 2
+            ;;
+        -q|--query)
+            QUERY="$2"
+            shift 2
+            ;;
+        -f|--format)
+            FORMAT="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            ;;
+        *)
+            echo "Unknown option: $1"
+            usage
+            ;;
+    esac
+done
+
+# Validate required arguments
+if [[ -z "$URL" ]]; then
+    echo "Error: Unraid URL is required (use -u or set UNRAID_URL)"
+    exit 1
+fi
+
+if [[ -z "$API_KEY" ]]; then
+    echo "Error: API key is required (use -k or set UNRAID_API_KEY)"
+    exit 1
+fi
+
+if [[ -z "$QUERY" ]]; then
+    echo "Error: GraphQL query is required (use -q)"
+    exit 1
+fi
+
+# Make the request
+RESPONSE=$(curl -skL -X POST "$URL" \
+    -H "Content-Type: application/json" \
+    -H "x-api-key: $API_KEY" \
+    -d "{\"query\":\"$QUERY\"}")
+
+# Check for errors
+if echo "$RESPONSE" | jq -e '.errors' > /dev/null 2>&1; then
+    # If we have data despite errors, and --ignore-errors is set, continue
+    if [[ "$IGNORE_ERRORS" == "true" ]] && echo "$RESPONSE" | jq -e '.data' > /dev/null 2>&1; then
+        echo "GraphQL Warning:" >&2
+        echo "$RESPONSE" | jq -r '.errors[0].message' >&2
+    else
+        echo "GraphQL Error:" >&2
+        echo "$RESPONSE" | jq -r '.errors[0].message' >&2
+        exit 1
+    fi
+fi
+
+# Output based on format
+case "$FORMAT" in
+    json)
+        echo "$RESPONSE"
+        ;;
+    raw)
+        echo "$RESPONSE" | jq -r '.data'
+        ;;
+    pretty)
+        echo "$RESPONSE" | jq '.'
+        ;;
+    *)
+        echo "Unknown format: $FORMAT" >&2
+        exit 1
+        ;;
+esac