feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/scripts/activate-enhanced-auth.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+
+/**
+ * Activate enhanced authentication in server.js
+ * This script safely updates the server configuration
+ */
+
+const fs = require('fs').promises;
+const path = require('path');
+
+async function activateEnhancedAuth() {
+  console.log('=== Activating Enhanced Authentication ===\n');
+  
+  try {
+    const serverPath = path.join(__dirname, '../server.js');
+    
+    // Read current server.js
+    let serverContent = await fs.readFile(serverPath, 'utf8');
+    
+    // Backup current server.js
+    const backupPath = `${serverPath}.backup.${Date.now()}`;
+    await fs.writeFile(backupPath, serverContent);
+    console.log(`✓ Created backup: ${path.basename(backupPath)}`);
+    
+    // Check current state
+    if (serverContent.includes("require('./src/routes/auth-enhanced')")) {
+      console.log('! Enhanced auth already active');
+      return;
+    }
+    
+    // Replace auth routes import
+    const originalLine = "const authRoutes = require('./src/routes/auth');";
+    const enhancedLine = "const authRoutes = require('./src/routes/auth-enhanced');";
+    
+    if (!serverContent.includes(originalLine)) {
+      console.log('✗ Could not find original auth import line');
+      console.log('Please manually update server.js');
+      return;
+    }
+    
+    serverContent = serverContent.replace(originalLine, enhancedLine);
+    console.log('✓ Updated auth routes import');
+    
+    // Add cleanup job initialization after database init
+    const dbInitLine = 'initializeDatabase()';
+    const cleanupAddition = `
+  // Initialize auth security cleanup job
+  const { initializeCleanupJob } = require('./src/utils/authSecurity');
+  initializeCleanupJob();
+`;
+    
+    if (!serverContent.includes('initializeCleanupJob')) {
+      const dbInitIndex = serverContent.indexOf(dbInitLine);
+      if (dbInitIndex !== -1) {
+        const insertPoint = serverContent.indexOf('\n', dbInitIndex) + 1;
+        serverContent = serverContent.slice(0, insertPoint) + cleanupAddition + serverContent.slice(insertPoint);
+        console.log('✓ Added cleanup job initialization');
+      }
+    }
+    
+    // Write updated server.js
+    await fs.writeFile(serverPath, serverContent);
+    console.log('✓ Updated server.js');
+    
+    console.log('\n✅ Enhanced authentication activated!');
+    console.log('\nNext steps:');
+    console.log('1. Restart the backend:');
+    console.log('   docker-compose restart backend');
+    console.log('\n2. Monitor auth health:');
+    console.log('   node scripts/monitor-auth-health.js');
+    console.log('\n3. To rollback if needed:');
+    console.log(`   cp ${path.basename(backupPath)} server.js`);
+    console.log('   docker-compose restart backend');
+    
+  } catch (error) {
+    console.error('❌ Error activating enhanced auth:', error);
+  }
+}
+
+activateEnhancedAuth();