security: comprehensive hardening across frontend, backend, and infrastructure

- Disable production source maps and hide nginx version
- Reduce JSON body limit from 10gb to 50mb (uploads use multer, not JSON)
- Strip database info and error details from health endpoint
- Mask reCAPTCHA secret key in admin settings API responses
- Whitelist sort/order query parameters in events and photos endpoints
- Stop reflecting arbitrary origins in static file CORS headers
- Align nginx security headers with backend Helmet CSP, remove deprecated X-XSS-Protection
- Strip EXIF metadata from generated thumbnails and hero images
- Bind postgres/redis dev ports to localhost in docker-compose configs
- Add safeExec utility (spawn with shell:false) to prevent command injection
- Convert all exec/execAsync calls in backup, restore, and database backup
  services to use safe spawn-based helpers

backend/src/services/imageProcessor.js

@@ -120,6 +120,9 @@ async function generateThumbnail(imagePath, options = {}) {
       failOnError: false // Don't fail on minor issues
     });
     
+    // Strip EXIF/metadata from thumbnails (privacy: prevent GPS leak etc.)
+    sharpInstance = sharpInstance.withMetadata(false);
+
     // Apply resize with configured settings
     // For square thumbnails with 'cover' fit, we crop to center
     sharpInstance = sharpInstance.resize(settings.width, settings.height, {
@@ -339,6 +342,9 @@ async function generateHeroImage(imagePath, options = {}) {
       failOnError: false
     });
 
+    // Strip EXIF/metadata from hero images (privacy: prevent GPS leak etc.)
+    sharpInstance = sharpInstance.withMetadata(false);
+
     // Resize to fit hero dimensions while maintaining aspect ratio
     // Use 'cover' to fill the hero area (crops if needed)
     sharpInstance = sharpInstance.resize(heroWidth, heroHeight, {