fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

api/pkg/authtoken/middleware.go

@@ -8,7 +8,7 @@ import (
 )
 
 const (
-	cookieName   = "jwt"
+	CookieName   = "jwt"
 	bearerPrefix = "bearer "
 )
 
@@ -71,7 +71,7 @@ func tokenFromHeader(r *http.Request) string {
 }
 
 func tokenFromCookie(r *http.Request) string {
-	cookie, err := r.Cookie(cookieName)
+	cookie, err := r.Cookie(CookieName)
 	if err != nil {
 		return ""
 	}