Fix: Reject multicast MACs (second byte = FF)

- 7e:ff:*.*:.*.* is multicast (bit 0 set)
- Reject any MAC with second byte = FF

package/src/client2server-minimal.lua

@@ -176,6 +176,9 @@ local function is_valid_mac(mac)
     -- First byte must not be 00 or FF (invalid/broadcast)
     local first = tonumber(parts[1], 16)
     if first == 0 or first == 255 then return false end
+    -- Second byte must not be FF (multicast/broadcast address)
+    local second = tonumber(parts[2], 16)
+    if second == 255 then return false end
     return true
 end