feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/migrations/add_must_change_password.js.old

@@ -0,0 +1,25 @@
+const { db } = require('../src/database/db');
+
+async function addMustChangePasswordColumn() {
+  try {
+    // Check if the column already exists
+    const hasMustChangePassword = await db.schema.hasColumn('admin_users', 'must_change_password');
+    
+    if (!hasMustChangePassword) {
+      await db.schema.table('admin_users', (table) => {
+        table.boolean('must_change_password').defaultTo(false);
+      });
+      
+      console.log('✅ Added must_change_password column to admin_users table');
+    } else {
+      console.log('ℹ️  must_change_password column already exists');
+    }
+    
+    process.exit(0);
+  } catch (error) {
+    console.error('❌ Migration failed:', error);
+    process.exit(1);
+  }
+}
+
+addMustChangePasswordColumn();