fix(security): address security vulnerabilities across frontend and backend

[stevenferey]

Summary

• Sanitize HTML in email templates — prevent stored XSS via malicious firstName during registration
• Remove AI API key from client bundle — VITE_AI_API_KEY was exported in the frontend JS, visible to anyone
• Require authentication for signature upload — add authenticate middleware on backend + credentials/token on frontend
• Require JWT secrets via environment variables — throw at startup instead of falling back to predictable defaults
• Enable SSL certificate verification for PostgreSQL — default rejectUnauthorized to true in production
• Remove PII (emails) from logs — replace email addresses with user IDs in backend and frontend logs
• Default cookie secure flag to true — only disable in explicit development mode
• Store access token in memory instead of localStorage — reduce XSS attack surface, rely on httpOnly refresh cookie
• Add helmet middleware — set standard HTTP security headers on all backend responses

Breaking changes

• JWT secrets required: The backend will refuse to start without JWT_ACCESS_SECRET and JWT_REFRESH_SECRET environment variables
• Session persistence: Users will need to re-login after deploy (access token is no longer persisted in localStorage; session recovery uses the httpOnly refresh cookie)
• SSL verification: Production deployments using self-signed DB certs must set DB_SSL_REJECT_UNAUTHORIZED=false

Test plan

• Vérifier que le backend démarre avec les variables JWT configurées
• Vérifier que le backend refuse de démarrer sans les variables JWT
• Tester login/logout/refresh — la session doit se restaurer via le cookie après rafraîchissement de page
• Tester l'upload de signature (doit fonctionner connecté, échouer déconnecté)
• Vérifier les headers de sécurité avec curl -I sur un endpoint
• Vérifier qu'un firstName contenant du HTML est échappé dans les emails
• Vérifier que aiApiKey n'apparaît plus dans le bundle JS (npm run build puis grep)

🤖 Generated with Claude Code