security: fix 17 vulnerabilities from comprehensive pentest

Fixes identified from full security audit covering auth, crypto,
injection, infrastructure, and configuration security.

Critical:
- C1: Fail-closed on unrecognized NODE_ENV (prevent DEV_SECRET in staging)
- C3: Validate API token expires_at (reject invalid dates that bypass expiry)

High:
- H1: Refresh JWT role from DB on each session (reflect demotions immediately)
- H2: Docker socket proxy for l4-port-manager (restrict API surface)
- H5: Block dangerous WAF custom directives (SecRuleEngine, SecAuditEngine)
- H7: Require explicit NEXTAUTH_TRUST_HOST instead of always trusting Host
- H8: Semantic validation of sync payload (block metadata SSRF, size limits)

Medium:
- M3: Rate limit password change current-password verification
- M5: Parameterized SQL in log/waf parsers (replace template literals)
- M6: Nonce-based CSP replacing unsafe-inline for script-src
- M9: Strip Caddy placeholders from rewrite path_prefix
- M10: Sanitize authentik outpostDomain (path traversal, placeholders)
- M14: Deny access on missing JWT role instead of defaulting to "user"

Low:
- L1: Require Origin header on mutating session-authenticated requests
- L4: Enforce password complexity on user password changes
- L5: Time-limited legacy SHA-256 key fallback (grace period until 2026-06-01)
- L6: Escape LIKE metacharacters in audit log search
- L7: Runtime-validate WAF excluded_rule_ids as positive integers

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/lib/caddy.ts

@@ -800,7 +800,8 @@ async function buildProxyRoutes(
       outpostRoute = {
         match: [
           {
-            path: [`/${authentik.outpostDomain}/*`]
+            // M10: Sanitize outpostDomain to prevent path traversal and placeholder injection
+            path: [`/${authentik.outpostDomain.replace(/\.\./g, '').replace(/\{[^}]*\}/g, '').replace(/\/+/g, '/')}/*`]
           }
         ],
         handle: [outpostHandler],
@@ -878,11 +879,15 @@ async function buildProxyRoutes(
     }
 
     // Structured path prefix rewrite
+    // M9: Sanitize path_prefix to prevent Caddy placeholder injection
     if (meta.rewrite?.path_prefix) {
-      handlers.push({
-        handler: "rewrite",
-        uri: `${meta.rewrite.path_prefix}{http.request.uri}`,
-      });
+      const safePrefix = meta.rewrite.path_prefix.replace(/\{[^}]*\}/g, '');
+      if (safePrefix) {
+        handlers.push({
+          handler: "rewrite",
+          uri: `${safePrefix}{http.request.uri}`,
+        });
+      }
     }
 
     const customHandlers = parseCustomHandlers(meta.custom_pre_handlers_json);