fix: address CodeRabbit security and validation issues in Fedora docs and backlog plan

Documentation improvements:
- Fix GitHub URL placeholder issues in install-fedora.md - GitHub /latest/download/ endpoint
  doesn't support version substitution, use explicit download URL pattern instead
- Improve security in network troubleshooting section:
  - Change ping target from claude.ai (marketing site) to api.anthropic.com (actual API)
  - Remove unsafe 'echo \$ANTHROPIC_API_KEY' command that exposes secrets in shell history
  - Use safe API key check with conditional output instead

Code improvements:
- apps/server/src/routes/backlog-plan/common.ts: Add Array.isArray() validation
  for stored plan shape before returning it. Ensures changes is actually an array,
  not just truthy, preventing downstream runtime errors.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

apps/server/src/routes/backlog-plan/common.ts

@@ -78,7 +78,7 @@ export async function loadBacklogPlan(projectPath: string): Promise<StoredBacklo
     const filePath = getBacklogPlanPath(projectPath);
     const raw = await secureFs.readFile(filePath, 'utf-8');
     const parsed = JSON.parse(raw as string) as StoredBacklogPlan;
-    if (!parsed?.result?.changes) {
+    if (!Array.isArray(parsed?.result?.changes)) {
       return null;
     }
     return parsed;