feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/scripts/test-auth-deployment.sh

@@ -0,0 +1,146 @@
+#!/bin/bash
+
+# Test authentication deployment
+# This script tests the enhanced auth without affecting production
+
+set -e
+
+echo "=== Testing Authentication Deployment ==="
+echo ""
+
+# Color codes
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Configuration
+API_URL="http://localhost:3001/api"
+TEST_USER="admin"
+TEST_PASS="wrong-password"
+
+echo -e "${BLUE}This script will test the authentication system${NC}"
+echo "It will make failed login attempts to test lockout"
+echo ""
+
+# Check if server is running
+echo -e "${BLUE}Checking server status...${NC}"
+if curl -s -f "$API_URL/../health" > /dev/null; then
+    echo -e "${GREEN}✓ Server is running${NC}"
+else
+    echo -e "${RED}✗ Server not accessible at $API_URL${NC}"
+    exit 1
+fi
+
+# Function to make login attempt
+make_login_attempt() {
+    local username=$1
+    local password=$2
+    local expected_status=$3
+    
+    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL/auth/admin/login" \
+        -H "Content-Type: application/json" \
+        -d "{\"username\":\"$username\",\"password\":\"$password\"}")
+    
+    http_code=$(echo "$response" | tail -n1)
+    body=$(echo "$response" | head -n-1)
+    
+    if [ "$http_code" -eq "$expected_status" ]; then
+        echo -e "${GREEN}✓${NC} Got expected status $http_code"
+        return 0
+    else
+        echo -e "${RED}✗${NC} Expected $expected_status, got $http_code"
+        echo "Response: $body"
+        return 1
+    fi
+}
+
+# Test 1: Normal failed login
+echo -e "\n${BLUE}Test 1: Normal failed login${NC}"
+make_login_attempt "$TEST_USER" "$TEST_PASS" 401
+
+# Test 2: Multiple failed attempts (testing lockout)
+echo -e "\n${BLUE}Test 2: Testing account lockout (5 attempts)${NC}"
+echo "Making 4 more failed attempts..."
+
+for i in {2..5}; do
+    echo -n "Attempt $i: "
+    make_login_attempt "$TEST_USER" "$TEST_PASS" 401
+    sleep 1
+done
+
+# Test 3: 6th attempt should be locked
+echo -e "\n${BLUE}Test 3: 6th attempt (should be locked if enhanced auth active)${NC}"
+echo -n "Attempt 6: "
+
+response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL/auth/admin/login" \
+    -H "Content-Type: application/json" \
+    -d "{\"username\":\"$TEST_USER\",\"password\":\"$TEST_PASS\"}")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | head -n-1)
+
+if [ "$http_code" -eq "423" ]; then
+    echo -e "${GREEN}✓ Account locked as expected!${NC}"
+    echo -e "${GREEN}Enhanced auth is ACTIVE${NC}"
+    echo "Lockout message: $(echo $body | jq -r '.error')"
+    ENHANCED_ACTIVE=true
+elif [ "$http_code" -eq "401" ]; then
+    echo -e "${YELLOW}! Still got 401 - Enhanced auth NOT active${NC}"
+    echo "Original auth is still in use"
+    ENHANCED_ACTIVE=false
+else
+    echo -e "${RED}✗ Unexpected status: $http_code${NC}"
+    echo "Response: $body"
+fi
+
+# Test 4: Check if we can query login attempts
+echo -e "\n${BLUE}Test 4: Checking login attempts table${NC}"
+
+if [ "$ENHANCED_ACTIVE" = true ]; then
+    # This would need database access, so we'll check via API behavior
+    echo -e "${GREEN}✓ Login tracking is active${NC}"
+else
+    echo -e "${YELLOW}! Login tracking not active (migrations might not be run)${NC}"
+fi
+
+# Test 5: Test logout endpoint
+echo -e "\n${BLUE}Test 5: Testing logout endpoint${NC}"
+
+# First need a valid token (this assumes you have one for testing)
+# For now, just check if endpoint exists
+logout_response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL/auth/logout" \
+    -H "Authorization: Bearer invalid-token")
+
+logout_code=$(echo "$logout_response" | tail -n1)
+
+if [ "$logout_code" -eq "200" ] || [ "$logout_code" -eq "401" ]; then
+    echo -e "${GREEN}✓ Logout endpoint exists${NC}"
+else
+    echo -e "${YELLOW}! Logout endpoint might not be active${NC}"
+fi
+
+# Summary
+echo -e "\n${BLUE}=== Summary ===${NC}"
+if [ "$ENHANCED_ACTIVE" = true ]; then
+    echo -e "${GREEN}✅ Enhanced authentication is ACTIVE${NC}"
+    echo "- Account lockout protection: Working"
+    echo "- Login attempt tracking: Active"
+    echo "- Enhanced security: Enabled"
+    echo ""
+    echo -e "${YELLOW}Note: Test account might be locked for 30 minutes${NC}"
+else
+    echo -e "${YELLOW}⚠️  Enhanced authentication is NOT ACTIVE${NC}"
+    echo "- Using original auth system"
+    echo "- No lockout protection"
+    echo "- No login tracking"
+    echo ""
+    echo "To activate:"
+    echo "1. Run migrations: docker exec wedding-photo-sharing-backend-1 npx knex migrate:latest"
+    echo "2. Update server.js to use auth-enhanced routes"
+    echo "3. Restart: docker-compose restart backend"
+fi
+
+echo ""
+echo "Test complete!"