Don’t Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)