Security & bug fixes (PR #2)

Discord RCON now enforces the rcon-allowed-commands allowlist (empty = deny all, * = allow all); sensitive auth commands always refused.

Fixed Discord admin check comparing user IDs against role IDs (privilege escalation).

Ticket claim/close buttons and ticket reply/close are admin-gated on both Discord and Telegram; ticket-system-enabled is now enforced; added syncshield.ticket / syncshield.report permission checks.

/syncshield config refuses to write secret keys; OP command notifications no longer relay sensitive commands (passwords in /login, /changepassword, …).

Chat from Telegram is stripped of Minecraft formatting codes; Discord ticket content sanitized against Markdown pings; link codes in Discord accepted only in DMs or via /mclink.

Ticket system hardening: 30s cooldown, 500-char cap, collision-safe ticket IDs.

Fixed NPE on join when player.getAddress() is null; inventory/ender-chest renders now snapshot state on the main thread; /syncshield reload refreshes Discord settings.

New TextSanitizer utility with JUnit coverage.

Minecraft 26.x support (PR #3)

Compiled against Spigot API 26.3; Minecraft 26.1 / 26.2 / 26.3 are supported, 1.16.X–1.21.X compatibility retained.

Fixed the legacy-material version check so 26.x no longer misreads as a pre-1.16 server.

Potion texture lookup prefers the modern PotionMeta#getBasePotionType() with a reflective fallback for older servers.

runServer dev task now launches Minecraft 26.3.