* Security: hardened all report REST routes and admin AJAX endpoints against SQL injection by parameterizing every query and forcing pagination values to integers.
* Security: fixed a stored/second-order SQL injection where the custom timezone setting was saved without validation; timezone values are now validated against known timezone identifiers and UTC offsets before storage.
* Security: added capability checks to the admin-facing statistics AJAX endpoints so site analytics can no longer be requested by unauthenticated or low-privilege users.
* Security: fixed reflected XSS and SQL injection in the IP history endpoint (output escaped, inputs sanitized and parameterized).
