Security fixes

1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting

backend/internal/config/config.go

@@ -3,7 +3,9 @@
 package config
 
 import (
-	"os" // Standard library for reading environment variables
+	"fmt" // formatted error messages
+	"os"  // Standard library for reading environment variables
+	"strings"
 
 	"github.com/joho/godotenv" // Third-party library for loading .env files
 )
@@ -23,7 +25,8 @@ type Config struct {
 	Port string // TCP port to listen on
 
 	// Security settings
-	JWTSecret string // Secret key for signing JWT tokens (keep this secret!)
+	JWTSecret      string   // Secret key for signing JWT tokens (keep this secret!)
+	TrustedProxies []string // IPs of trusted reverse proxies (for X-Forwarded-For)
 
 	// Admin user configuration (used when --reset-admin-password is not used)
 	AdminUser     string // Username for the admin account
@@ -109,9 +112,34 @@ func Load() *Config {
 
 		// Application URL (for generating links in emails)
 		BaseURL: getEnv("BASE_URL", "http://localhost:8080"),
+
+		// Trusted proxies (comma-separated IPs)
+		TrustedProxies: parseTrustedProxies(getEnv("TRUSTED_PROXIES", "")),
 	}
 }
 
+func parseTrustedProxies(s string) []string {
+	if s == "" {
+		return nil
+	}
+	parts := strings.Split(s, ",")
+	result := make([]string, 0, len(parts))
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p != "" {
+			result = append(result, p)
+		}
+	}
+	return result
+}
+
+func (c *Config) Validate() error {
+	if len(c.JWTSecret) < 32 {
+		return fmt.Errorf("JWT_SECRET must be at least 32 characters long")
+	}
+	return nil
+}
+
 // getEnv reads an environment variable or returns a default value.
 // key: the name of the environment variable.
 // defaultValue: the value to return if the environment variable is not set.