fix: production JSON parsing errors and trust proxy issue

- Set Express to trust proxy headers for proper IP detection with Traefik
- Add safe JSON parsing for email template variables and activity log metadata
- Create migration to fix invalid JSON data in database
- Add error handling to prevent JSON.parse crashes

This fixes the 500 errors caused by invalid JSON data and the trust proxy
warning from express-rate-limit when running behind Traefik.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/routes/adminEmail.js

@@ -164,7 +164,16 @@ router.get('/templates', adminAuth, async (req, res) => {
       const result = {
         id: template.id,
         template_key: template.template_key,
-        variables: template.variables ? JSON.parse(template.variables) : [],
+        variables: (() => {
+        try {
+          if (!template.variables) return [];
+          if (typeof template.variables === 'object') return template.variables;
+          return JSON.parse(template.variables);
+        } catch (e) {
+          console.warn('Failed to parse variables for template:', template.template_key, e.message);
+          return [];
+        }
+      })(),
         updated_at: template.updated_at
       };
       
@@ -212,7 +221,16 @@ router.get('/templates/:key', adminAuth, async (req, res) => {
     const response = {
       id: template.id,
       template_key: template.template_key,
-      variables: template.variables ? JSON.parse(template.variables) : [],
+      variables: (() => {
+        try {
+          if (!template.variables) return [];
+          if (typeof template.variables === 'object') return template.variables;
+          return JSON.parse(template.variables);
+        } catch (e) {
+          console.warn('Failed to parse variables for template:', template.template_key, e.message);
+          return [];
+        }
+      })(),
       updated_at: template.updated_at
     };
     

backend/src/routes/adminNotifications.js

@@ -32,7 +32,16 @@ router.get('/', adminAuth, async (req, res) => {
       actorName: notification.actor_name,
       eventName: notification.event_name,
       eventId: notification.event_id,
-      metadata: notification.metadata ? JSON.parse(notification.metadata) : {},
+      metadata: (() => {
+        try {
+          if (!notification.metadata) return {};
+          if (typeof notification.metadata === 'object') return notification.metadata;
+          return JSON.parse(notification.metadata);
+        } catch (e) {
+          console.warn('Failed to parse metadata for notification:', notification.id, e.message);
+          return {};
+        }
+      })(),
       createdAt: notification.created_at,
       readAt: notification.read_at,
       isRead: !!notification.read_at