Follow-up on jmpsec#813 (merged) addressing two review threads:

== Per-service --auth defaults ==

The shared `initServiceFlags` was applying a single `--auth` default
across all three services, which produced the wrong `--help` output
for osctrl-tls (which authenticates osquery nodes via the per-env
enroll secret, not via this flag — `none` is the correct default for
it).

Split the `--auth` flag out of `initServiceFlags` into a new
`initAuthFlag(params, defaultValue)` helper and call it from each
service's `Init*Flags` with the semantically correct default:

  - osctrl-api   → `jwt`   (closes U-AUTH-1, the audit-flagged
                            "unauthenticated by default" finding)
  - osctrl-admin → `db`    (its existing browser login form)
  - osctrl-tls   → `none`  (osquery nodes auth via enroll secret;
                            tls's main.go does not read this field)

Usage text reverted to "Authentication mechanism for the service" per
review feedback — the env-var note is intentionally not in help text;
operators who set `--auth=none` on osctrl-api see the actionable
error message at startup from `guardAuthMode` instead.

== Carve path: replace regex gate with SQL string-literal escape ==

The previous `ValidCarvePath` regex blocked legitimate paths that
contain spaces, parentheses, or non-ASCII characters (e.g.
`C:\Program Files\Common Files\app.log`,
`/Library/Application Support/com.example/cfg`,
`/home/álvaro/notes.txt`). Replaced with a splice-site defense:

  - `escapeSQLString` doubles single quotes so an attempted injection
    like `'; SELECT 1; --` becomes the literal contents of the SQL
    string literal — there is no way to break out of the surrounding
    quotes.
  - For glob mode, `escapeLikePattern` escapes the LIKE meta-chars
    (`\`, `%`, `_`) with `\` so pre-existing LIKE characters in the
    path stay literal, then `*`/`?` map to `%`/`_`. The query emits
    `ESCAPE '\'` so the parser respects the escapes.
  - `globToLike` runs the LIKE escape first, then the glob mapping,
    then the SQL-quote escape — the order matters and is documented.

Removed `ValidCarvePath` / `validCarvePath` and the precheck call in
`CarvesRunHandler`. Test coverage:

  - injection attempts on both exact and glob branches
  - legitimate Windows / macOS / UTF-8 paths that the old regex
    would have rejected
  - glob mapping with literal-meta-char escapes
  - SQL shape sanity for happy paths

Verified locally:
  - go build ./...  (clean)
  - go vet ./...    (clean)
  - go test ./...   (all packages green; 4 new carve tests pass)
  - osctrl-api/admin/tls --help all show the correct per-service
    auth default
  - Live smoke on a dev stack against real Postgres: 4 carve requests
    with Windows-with-spaces, macOS Application Support, UTF-8, and
    the classic injection string all land as expected — the
    injection's single quote is doubled to `''` in the persisted SQL,
    and SQLite parses the result as one literal string.