Fix CSRF upgrade path: remove stale file before creating directory

Old versions stored CSRF/flash as plain files at the directory path.
New code expects directories. _ensure_dir now removes conflicting
plain files left by older versions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

whm/gniza-whm/lib/GnizaWHM/UI.pm

@@ -125,6 +125,8 @@ sub render_flash {
 
 sub _ensure_dir {
     my ($dir) = @_;
+    # Remove stale plain file left by older versions (upgrade path)
+    unlink $dir if -e $dir && ! -d $dir;
     unless (-d $dir) {
         mkdir $dir, 0700;
     }