fix: address 18 CRITICAL+HIGH PR review comments

**Critical Fixes (7 issues):**
- Fix GraphQL schema field names in users tool (role→roles, remove email)
- Fix GraphQL mutation signatures (addUserInput, deleteUser input)
- Fix dict(None) TypeError guards in users tool (use `or {}` pattern)
- Fix FastAPI version constraint (0.116.1→0.115.0)
- Fix WebSocket SSL context handling (support CA bundles, bool, and None)
- Fix critical disk threshold treated as warning (split counters)

**High Priority Fixes (11 issues):**
- Fix Docker update/remove action response field mapping
- Fix path traversal vulnerability in log validation (normalize paths)
- Fix deleteApiKeys validation (check response before success)
- Fix rclone create_remote validation (check response)
- Fix keys input_data type annotation (dict[str, Any])
- Fix VM domain/domains fallback restoration

**Changes by file:**
- unraid_mcp/tools/docker.py: Response field mapping
- unraid_mcp/tools/info.py: Split critical/warning counters
- unraid_mcp/tools/storage.py: Path normalization for traversal protection
- unraid_mcp/tools/users.py: GraphQL schema + null handling
- unraid_mcp/tools/keys.py: Validation + type annotations
- unraid_mcp/tools/rclone.py: Response validation
- unraid_mcp/tools/virtualization.py: Domain fallback
- unraid_mcp/subscriptions/manager.py: SSL context creation
- pyproject.toml: FastAPI version fix
- tests/*: New tests for all fixes

**Review threads resolved:**
PRRT_kwDOO6Hdxs5uu70L, PRRT_kwDOO6Hdxs5uu70O, PRRT_kwDOO6Hdxs5uu70V,
PRRT_kwDOO6Hdxs5uu70e, PRRT_kwDOO6Hdxs5uu70i, PRRT_kwDOO6Hdxs5uu7zn,
PRRT_kwDOO6Hdxs5uu7z_, PRRT_kwDOO6Hdxs5uu7sI, PRRT_kwDOO6Hdxs5uu7sJ,
PRRT_kwDOO6Hdxs5uu7sK, PRRT_kwDOO6Hdxs5uu7Tk, PRRT_kwDOO6Hdxs5uu7Tn,
PRRT_kwDOO6Hdxs5uu7Tr, PRRT_kwDOO6Hdxs5uu7Ts, PRRT_kwDOO6Hdxs5uu7Tu,
PRRT_kwDOO6Hdxs5uu7Tv, PRRT_kwDOO6Hdxs5uu7Tw, PRRT_kwDOO6Hdxs5uu7Tx

All tests passing.

Co-authored-by: docker-fixer <agent@pr-fixes>
Co-authored-by: info-fixer <agent@pr-fixes>
Co-authored-by: storage-fixer <agent@pr-fixes>
Co-authored-by: users-fixer <agent@pr-fixes>
Co-authored-by: config-fixer <agent@pr-fixes>
Co-authored-by: websocket-fixer <agent@pr-fixes>
Co-authored-by: keys-rclone-fixer <agent@pr-fixes>
Co-authored-by: vm-fixer <agent@pr-fixes>

tests/test_users.py

@@ -42,7 +42,7 @@ class TestUsersValidation:
 
 class TestUsersActions:
     async def test_me(self, _mock_graphql: AsyncMock) -> None:
-        _mock_graphql.return_value = {"me": {"id": "u:1", "name": "root", "role": "ADMIN"}}
+        _mock_graphql.return_value = {"me": {"id": "u:1", "name": "root", "description": "", "roles": ["ADMIN"]}}
         tool_fn = _make_tool()
         result = await tool_fn(action="me")
         assert result["name"] == "root"
@@ -56,19 +56,19 @@ class TestUsersActions:
         assert len(result["users"]) == 2
 
     async def test_get(self, _mock_graphql: AsyncMock) -> None:
-        _mock_graphql.return_value = {"user": {"id": "u:1", "name": "root", "role": "ADMIN"}}
+        _mock_graphql.return_value = {"user": {"id": "u:1", "name": "root", "description": "", "roles": ["ADMIN"]}}
         tool_fn = _make_tool()
         result = await tool_fn(action="get", user_id="u:1")
         assert result["name"] == "root"
 
     async def test_add(self, _mock_graphql: AsyncMock) -> None:
-        _mock_graphql.return_value = {"addUser": {"id": "u:3", "name": "newuser", "role": "USER"}}
+        _mock_graphql.return_value = {"addUser": {"id": "u:3", "name": "newuser", "description": "", "roles": ["USER"]}}
         tool_fn = _make_tool()
         result = await tool_fn(action="add", name="newuser", password="pass123")
         assert result["success"] is True
 
     async def test_add_with_role(self, _mock_graphql: AsyncMock) -> None:
-        _mock_graphql.return_value = {"addUser": {"id": "u:3", "name": "admin2", "role": "ADMIN"}}
+        _mock_graphql.return_value = {"addUser": {"id": "u:3", "name": "admin2", "description": "", "roles": ["ADMIN"]}}
         tool_fn = _make_tool()
         result = await tool_fn(action="add", name="admin2", password="pass123", role="admin")
         assert result["success"] is True
@@ -76,10 +76,12 @@ class TestUsersActions:
         assert call_args[0][1]["input"]["role"] == "ADMIN"
 
     async def test_delete(self, _mock_graphql: AsyncMock) -> None:
-        _mock_graphql.return_value = {"deleteUser": True}
+        _mock_graphql.return_value = {"deleteUser": {"id": "u:2", "name": "guest"}}
         tool_fn = _make_tool()
         result = await tool_fn(action="delete", user_id="u:2", confirm=True)
         assert result["success"] is True
+        call_args = _mock_graphql.call_args
+        assert call_args[0][1]["input"]["id"] == "u:2"
 
     async def test_cloud(self, _mock_graphql: AsyncMock) -> None:
         _mock_graphql.return_value = {"cloud": {"status": "connected", "apiKey": "***"}}
@@ -98,3 +100,31 @@ class TestUsersActions:
         tool_fn = _make_tool()
         result = await tool_fn(action="origins")
         assert len(result["origins"]) == 2
+
+
+class TestUsersNoneHandling:
+    """Verify actions return empty dict (not TypeError) when API returns None."""
+
+    async def test_me_returns_none(self, _mock_graphql: AsyncMock) -> None:
+        _mock_graphql.return_value = {"me": None}
+        tool_fn = _make_tool()
+        result = await tool_fn(action="me")
+        assert result == {}
+
+    async def test_get_returns_none(self, _mock_graphql: AsyncMock) -> None:
+        _mock_graphql.return_value = {"user": None}
+        tool_fn = _make_tool()
+        result = await tool_fn(action="get", user_id="u:1")
+        assert result == {}
+
+    async def test_cloud_returns_none(self, _mock_graphql: AsyncMock) -> None:
+        _mock_graphql.return_value = {"cloud": None}
+        tool_fn = _make_tool()
+        result = await tool_fn(action="cloud")
+        assert result == {}
+
+    async def test_remote_access_returns_none(self, _mock_graphql: AsyncMock) -> None:
+        _mock_graphql.return_value = {"remoteAccess": None}
+        tool_fn = _make_tool()
+        result = await tool_fn(action="remote_access")
+        assert result == {}