fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

features/activity-log-backend.feature

@@ -358,6 +358,8 @@ Feature: The back-office keeps an append-only activity log that owners can read
         | target | +1+1             | '+1+1             |
         | target | -2               | '-2               |
         | actor  | @SUM(A1)         | '@SUM(A1)         |
+        | target | \t=cmd           | '\t=cmd           |
+        | target | \r=cmd           | '\r=cmd           |
         | target | Spring release   | Spring release    |
         | target | a=b              | a=b               |