fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

api/handlers/article/articleHandler.go

@@ -506,6 +506,11 @@ func isVerifiedCaller(r *http.Request, getUser *useCases.GetUserUseCase) bool {
 		return false
 	}
 
+	tokenVersion, ok := claims.TokenVersion(r)
+	if !ok || tokenVersion != currentUser.TokenVersion {
+		return false
+	}
+
 	return currentUser.IsVerified
 }