refactor: simplify path validation and connection_init via shared helpers

- Extract _validate_path() in unraid.py — consolidates traversal check + normpath
  + prefix validation used by disk/logs and live/log_tail into one place
- Extract build_connection_init() in subscriptions/utils.py — removes 4 duplicate
  connection_init payload blocks from snapshot.py (×2), manager.py, diagnostics.py;
  also fixes diagnostics.py bug where x-api-key: None was sent when no key configured
- Remove _LIVE_ALLOWED_LOG_PREFIXES alias — direct reference to _ALLOWED_LOG_PREFIXES
- Move import hmac to module level in server.py (was inside verify_token hot path)

Co-Authored-By: Claude <noreply@anthropic.com>

unraid_mcp/subscriptions/snapshot.py

@@ -18,10 +18,9 @@ from typing import Any
 import websockets
 from websockets.typing import Subprotocol
 
-from ..config import settings as _settings
 from ..config.logging import logger
 from ..core.exceptions import ToolError
-from .utils import build_ws_ssl_context, build_ws_url
+from .utils import build_connection_init, build_ws_ssl_context, build_ws_url
 
 
 async def subscribe_once(
@@ -48,10 +47,7 @@ async def subscribe_once(
         sub_id = "snapshot-1"
 
         # Handshake
-        init: dict[str, Any] = {"type": "connection_init"}
-        if _settings.UNRAID_API_KEY:
-            init["payload"] = {"x-api-key": _settings.UNRAID_API_KEY}
-        await ws.send(json.dumps(init))
+        await ws.send(json.dumps(build_connection_init()))
 
         raw = await asyncio.wait_for(ws.recv(), timeout=timeout)
         ack = json.loads(raw)
@@ -123,10 +119,7 @@ async def subscribe_collect(
         proto = ws.subprotocol or "graphql-transport-ws"
         sub_id = "snapshot-1"
 
-        init: dict[str, Any] = {"type": "connection_init"}
-        if _settings.UNRAID_API_KEY:
-            init["payload"] = {"x-api-key": _settings.UNRAID_API_KEY}
-        await ws.send(json.dumps(init))
+        await ws.send(json.dumps(build_connection_init()))
 
         raw = await asyncio.wait_for(ws.recv(), timeout=timeout)
         ack = json.loads(raw)