Security fixes

1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting

backend/.env.example

@@ -8,7 +8,8 @@ DB_NAME=mailserver
 # App
 PORT=8080
 USE_EMBEDDED=true
-JWT_SECRET=change-this-to-a-random-secret
+JWT_SECRET=your-random-secret-at-least-32-chars
+TRUSTED_PROXIES=127.0.0.1
 
 # Mail server paths
 MAIL_DATA_DIR=/var/vmail