fix(frontend): keep node-reported values one URL path segment

InboundInfoModal put a client's email into /panel/api/clients/ips and
clearIps unencoded, and the host mutations did the same with a host
group id. Both values reach the master from a node's sync without the
panel's own character rules, so "../" and "?" in them chose the route
and query of the admin's authenticated POST; the IP-log request fires as
soon as the window opens. Encode them as every other client route in
the SPA already does.

frontend/src/api/queries/useHostMutations.ts

@@ -20,14 +20,19 @@ export function useHostMutations() {
 
   const updateMut = useMutation({
     mutationFn: ({ groupId, payload }: { groupId: string; payload: BulkAddHostValues }) =>
-      HttpUtil.post(`/panel/api/hosts/update/${groupId}`, payload, JSON_HEADERS),
+      HttpUtil.post(
+        `/panel/api/hosts/update/${encodeURIComponent(groupId)}`,
+        payload,
+        JSON_HEADERS,
+      ),
     onSuccess: (msg) => {
       if (msg?.success) invalidate();
     },
   });
 
   const removeMut = useMutation({
-    mutationFn: (groupId: string) => HttpUtil.post(`/panel/api/hosts/del/${groupId}`),
+    mutationFn: (groupId: string) =>
+      HttpUtil.post(`/panel/api/hosts/del/${encodeURIComponent(groupId)}`),
     onSuccess: (msg) => {
       if (msg?.success) invalidate();
     },
@@ -35,7 +40,7 @@ export function useHostMutations() {
 
   const setEnableMut = useMutation({
     mutationFn: ({ groupId, enable }: { groupId: string; enable: boolean }) =>
-      HttpUtil.post(`/panel/api/hosts/setEnable/${groupId}`, { enable }),
+      HttpUtil.post(`/panel/api/hosts/setEnable/${encodeURIComponent(groupId)}`, { enable }),
     onSuccess: (msg) => {
       if (msg?.success) invalidate();
     },