fix: prevent command injection via docker options eval

Values supplied through docker options, `--ttl-seconds`, and `-e` flowed into a Bash `eval` during build, deploy, and run, letting a low-privileged user execute arbitrary commands on the host as the dokku user. These arguments are now tokenized and passed through to the container verbatim, without shell expansion. A one-time migration repairs stored labels whose backticks were saved with a stray backslash so Traefik-style rules stay valid on the next deploy.

plugins/run/internal-functions

@@ -86,6 +86,10 @@ fn-run() {
     DOKKU_RUN_TTL_SECONDS="86400"
   fi
 
+  if ! is_number "$DOKKU_RUN_TTL_SECONDS"; then
+    dokku_log_fail "--ttl-seconds must be a positive integer"
+  fi
+
   if [[ "$CMD" == "run:detached" ]] && [[ "$DOKKU_FORCE_TTY" != "true" ]]; then
     export DOKKU_DISABLE_TTY=true
   fi