CatDV Server: Authenticated aaftoolPath Property Injection Root RCE

An authenticated administrator can inject the catdv.aaftoolPath JVM system property via PUT /catdv/api/1/settings/server-config/{id} (ServerSettings.loadSettingsFromDatabase applies System.setProperty with no whitelist) and trigger GET /catdv/api/1/clips?fmt=aaf, where AAFExportHandler runs the attacker-controlled path via ProcessUtils.exec as root. The property auto-applies via CacheManager.checkCaches with a 1s throttle and no restart needed.