feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

backend/AUTH_SECURITY_SUMMARY.md

@@ -0,0 +1,119 @@
+# Authentication Security Enhancement Summary
+
+## Security Issues Fixed
+
+### 1. ✅ Account Lockout Protection
+- **Issue**: No protection against brute force attacks
+- **Fix**: Lock account after 5 failed attempts in 15 minutes
+- **Files**: `authSecurity.js`, `login_attempts` table
+
+### 2. ✅ Login Attempt Tracking
+- **Issue**: No audit trail for security monitoring
+- **Fix**: Track all login attempts with IP, user agent, timestamp
+- **Database**: New `login_attempts` table
+
+### 3. ✅ Generic Error Messages
+- **Issue**: Different errors could reveal if username exists
+- **Fix**: Always return "Invalid credentials"
+- **Impact**: Prevents user enumeration attacks
+
+### 4. ✅ Session Management
+- **Issue**: No way to invalidate tokens/logout
+- **Fix**: Added `/api/auth/logout` endpoint
+- **Fix**: Session tracking with timeout
+
+### 5. ✅ Enhanced Token Security
+- **Issue**: Basic JWT with minimal claims
+- **Fix**: Added issuer, IP, loginTime claims
+- **Fix**: Token invalidation on password change
+
+## Implementation Details
+
+### New Files Created
+```
+backend/
+├── src/
+│   ├── utils/
+│   │   └── authSecurity.js (122 lines)
+│   ├── middleware/
+│   │   └── auth-enhanced.js (169 lines)
+│   └── routes/
+│       └── auth-enhanced.js (244 lines)
+├── migrations/
+│   ├── 015_add_login_attempts_table.js
+│   └── 016_add_auth_security_columns.js
+└── scripts/
+    └── test-auth-security.js
+```
+
+### Database Changes
+1. **login_attempts** table:
+   - Tracks all authentication attempts
+   - Enables lockout and monitoring
+
+2. **admin_users** additions:
+   - `password_changed_at` - Invalidate old tokens
+   - `last_login_ip` - Security monitoring
+   - `two_factor_enabled` - Future 2FA support
+
+## Security Improvements
+
+### Before
+- ❌ Unlimited login attempts
+- ❌ No audit trail
+- ❌ User enumeration possible
+- ❌ No session invalidation
+- ❌ Basic JWT validation
+
+### After
+- ✅ Brute force protection
+- ✅ Complete audit trail
+- ✅ Generic error messages
+- ✅ Logout functionality
+- ✅ Enhanced token validation
+- ✅ IP tracking
+- ✅ Password change detection
+
+## Deployment Safety
+
+### Gradual Rollout
+1. **Phase 1**: Deploy code (no impact)
+2. **Phase 2**: Run migrations (adds tables only)
+3. **Phase 3**: Initialize tracking (monitoring only)
+4. **Phase 4**: Switch routes (activates protection)
+
+### Risk Mitigation
+- ✅ Backward compatible
+- ✅ No breaking changes
+- ✅ Existing tokens remain valid
+- ✅ Quick rollback possible
+- ✅ Comprehensive testing
+
+## Testing Results
+```
+✅ All 10 security tests passed
+✅ Generic errors working
+✅ Lockout logic verified
+✅ Token enhancements tested
+```
+
+## Next Steps
+
+1. **Deploy database migrations** (safe)
+2. **Deploy new files** (no impact)
+3. **Test in staging** if available
+4. **Gradual production rollout**
+5. **Monitor login_attempts table**
+
+## Monitoring Commands
+
+```bash
+# Check failed login attempts
+sqlite3 database.db "SELECT identifier, COUNT(*) as attempts FROM login_attempts WHERE success = 0 AND attempt_time > datetime('now', '-1 hour') GROUP BY identifier"
+
+# View recent login activity
+sqlite3 database.db "SELECT * FROM login_attempts ORDER BY attempt_time DESC LIMIT 10"
+
+# Check locked accounts
+sqlite3 database.db "SELECT identifier FROM login_attempts WHERE success = 0 GROUP BY identifier HAVING COUNT(*) >= 5"
+```