feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/SQL_INJECTION_FIX_ROLLBACK.md

@@ -0,0 +1,94 @@
+# SQL Injection Fix Rollback Plan
+
+## Overview
+This document provides a rollback plan in case the SQL injection fixes cause issues in production.
+
+## Changes Made
+1. **Created**: `backend/src/utils/sqlSecurity.js` - Central security utilities
+2. **Modified**: `backend/src/routes/adminDashboard.js` - Replaced whereRaw with parameterized queries
+3. **Modified**: `backend/src/routes/adminPhotos.js` - Added LIKE pattern escaping
+4. **Modified**: `backend/src/routes/adminEvents.js` - Added LIKE pattern escaping
+
+## Quick Rollback Steps
+
+### Step 1: Revert Code Changes
+If issues occur, run these commands to revert:
+
+```bash
+# Navigate to backend directory
+cd backend
+
+# Revert specific files
+git checkout HEAD -- src/routes/adminDashboard.js
+git checkout HEAD -- src/routes/adminPhotos.js
+git checkout HEAD -- src/routes/adminEvents.js
+
+# Remove the new security utility file
+rm src/utils/sqlSecurity.js
+```
+
+### Step 2: Restart Services
+```bash
+# If using Docker
+docker-compose restart backend
+
+# If using PM2
+pm2 restart picpeak-backend
+```
+
+## Verification After Rollback
+
+1. Check admin dashboard loads: `/admin/dashboard`
+2. Test event search functionality
+3. Test photo search functionality
+4. Verify analytics charts display correctly
+
+## Symptoms That May Require Rollback
+
+1. **Dashboard Statistics Not Loading**
+   - Empty or NaN values in stats
+   - Analytics charts not rendering
+
+2. **Search Features Broken**
+   - Event search returns no results
+   - Photo search returns errors
+   - Special characters in search causing issues
+
+3. **Date Filtering Issues**
+   - Activity logs not showing correct date ranges
+   - Analytics showing incorrect time periods
+
+## Safe Testing Before Production
+
+1. **Test in Development First**:
+   ```bash
+   cd backend
+   npm run dev
+   ```
+
+2. **Test Key Features**:
+   - Admin dashboard stats: `http://localhost:3001/api/admin/dashboard/stats`
+   - Analytics: `http://localhost:3001/api/admin/dashboard/analytics?days=7`
+   - Event search: `http://localhost:3001/api/admin/events?search=test`
+   - Photo search: `http://localhost:3001/api/admin/events/1/photos?search=test`
+
+3. **Monitor Logs**:
+   ```bash
+   # Docker logs
+   docker-compose logs -f backend
+
+   # PM2 logs
+   pm2 logs picpeak-backend
+   ```
+
+## Emergency Contacts
+- Keep database backups before deploying
+- Have monitoring alerts for 500 errors
+- Document any custom SQL queries in use
+
+## Post-Rollback Actions
+If rollback is needed:
+1. Document the specific issue encountered
+2. Create test cases for the failure scenario
+3. Fix the issue in development
+4. Re-test thoroughly before re-deploying