feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/SQL_INJECTION_FIX_SUMMARY.md

@@ -0,0 +1,64 @@
+# SQL Injection Fix Summary
+
+## Quick Overview
+Fixed SQL injection vulnerabilities in the admin panel endpoints by:
+1. Replacing dangerous `whereRaw` queries with parameterized queries
+2. Escaping special characters in LIKE patterns
+3. Validating sort columns and orders
+
+## Test Results
+✅ All 31 security tests passed
+✅ Verification script confirms fixes working
+✅ No breaking changes to API functionality
+
+## Changed Files
+```
+backend/
+├── src/
+│   ├── utils/
+│   │   └── sqlSecurity.js (NEW - 117 lines)
+│   └── routes/
+│       ├── adminDashboard.js (6 changes)
+│       ├── adminEvents.js (2 changes)
+│       └── adminPhotos.js (2 changes)
+└── scripts/
+    ├── test-sql-security.js (NEW)
+    └── verify-sql-fixes.js (NEW)
+```
+
+## Before & After Examples
+
+### Date Range Queries
+```javascript
+// ❌ BEFORE (Vulnerable)
+.whereRaw(`timestamp >= datetime("now", "-${days} days")`)
+
+// ✅ AFTER (Safe)
+const startDate = new Date();
+startDate.setDate(startDate.getDate() - sanitizeDays(days));
+.where('timestamp', '>=', startDate.toISOString())
+```
+
+### LIKE Queries
+```javascript
+// ❌ BEFORE (Vulnerable)
+.where('event_name', 'like', `%${search}%`)
+
+// ✅ AFTER (Safe)
+const escapedSearch = escapeLikePattern(search);
+.where('event_name', 'like', `%${escapedSearch}%`)
+```
+
+## Deployment Checklist
+- [ ] Run `node scripts/test-sql-security.js` (should show 31/31 passed)
+- [ ] Test in development environment
+- [ ] Review rollback plan (`SQL_INJECTION_FIX_ROLLBACK.md`)
+- [ ] Deploy to production
+- [ ] Monitor logs for errors
+- [ ] Test search functionality with special characters
+
+## Risk Assessment
+- **Risk Level**: Low (with proper testing)
+- **Breaking Changes**: None
+- **Performance Impact**: Minimal
+- **Rollback Time**: < 2 minutes