security: harden backend (CORS, trustProxy, rate-limit, upload validation, nosniff)

- Fix refresh-token invalidation bug: invalid tokens no longer wipe
  all sessions globally (auth.ts)
- Replace wildcard CORS with config-driven origin allowlist.
  Default: no CORS headers. Configurable via allowedOrigins in
  backend-config.json or ALLOWED_ORIGINS env var (comma-separated)
- Add trustProxy config flag (default false). x-forwarded-*
  headers are now ignored unless explicitly opted in
- Add in-memory brute-force rate limiting for login and groupLogin:
  7 failed attempts → 15-minute block (HTTP 429)
- Validate image uploads by magic bytes (PNG/JPEG/WEBP), not just
  file extension
- Add X-Content-Type-Options: nosniff to all static file responses

Signed-off-by: Mike Lischke <mike@lischke-online.de>

Author: mike-lischke

src/server/auth.ts

@@ -263,8 +263,6 @@ export const verifyAndRotateRefreshToken = async (adapter: IDatabaseAdapter,
     );
 
     if (rows.length === 0) {
-        await adapter.execute("UPDATE users SET refresh_token_hash = NULL WHERE refresh_token_hash IS NOT NULL");
-
         return undefined;
     }