feat: PVE host management and VM control

- Add PVE host management page (/pve-hosts)
- Add PVE host CRUD operations with connection test
- Add VM start/stop buttons on machine list cards
- Auto-detect PVE host status on page load
- Add VM ID validation (frontend + backend)
- Fix PVE status detection logic (online vs ok)
- Update Dream2.0 theme CSS variables
- Fix visitor mode grid layout

server/handlers/pve.go

@@ -248,6 +248,12 @@ func (h *PVEHandler) VMStatus(c *gin.Context) {
 		return
 	}
 
+	// 验证 VM ID 格式（必须是正整数）
+	if _, err := strconv.Atoi(pveVMID.String); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid VM ID format"})
+		return
+	}
+
 	status, err := h.service.GetVMStatus(*pveHostID, pveVMID.String)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -283,6 +289,12 @@ func (h *PVEHandler) VMStart(c *gin.Context) {
 		return
 	}
 
+	// 验证 VM ID 格式（必须是正整数）
+	if _, err := strconv.Atoi(pveVMID.String); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid VM ID format"})
+		return
+	}
+
 	if err := h.service.StartVM(*pveHostID, pveVMID.String); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -323,6 +335,12 @@ func (h *PVEHandler) VMStop(c *gin.Context) {
 		return
 	}
 
+	// 验证 VM ID 格式（必须是正整数）
+	if _, err := strconv.Atoi(pveVMID.String); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid VM ID format"})
+		return
+	}
+
 	if err := h.service.StopVM(*pveHostID, pveVMID.String); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return