fix(security): validate admin event inputs

[pushkart2]

Summary

• validate client-selected admin actions and target players before dispatch
• perform permission checks before radio export and player lookups
• constrain report replies, ban reasons, routing buckets, radio frequencies, weapon groups, and permission names
• route report replies using server-owned report data instead of client-supplied target data
• safely handle players disconnecting during callbacks

Validation

• direct Lua 5.4 syntax/control-flow review
• git diff --check

The resource lint workflow is expected to run on this draft PR; any reported lint violations will be fixed on this branch.