Security fixes

1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting

backend/cmd/server/main.go

@@ -54,6 +54,10 @@ func main() {
 	// See config.Load() for all available environment variables.
 	cfg := config.Load()
 
+	if err := cfg.Validate(); err != nil {
+		log.Fatalf("Invalid configuration: %v", err)
+	}
+
 	// Override configuration with command-line flags if they were provided.
 	// Empty string means the flag was not set, so we keep the config value.
 	if *bind != "" {