fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

features/login_and_password_reset_rate_limiting.feature

@@ -16,7 +16,8 @@ Feature: Login and password-reset requests are rate-limited per client IP
       (github.com/go-chi/chi/v5/middleware) runs first and rewrites r.RemoteAddr from
       X-Forwarded-For/X-Real-IP when present (matching the nginx reverse proxy setup in
       docs/deployment.md that already sets X-Forwarded-For), falling back to the raw RemoteAddr
-      otherwise; RateLimiter keys its counters on r.RemoteAddr
+      otherwise; RateLimiter keys its counters on the host portion of r.RemoteAddr (the source
+      port is ignored, so opening a new connection never yields a fresh counter)
     And RateLimiter(maxAttempts int, window time.Duration) func(http.Handler) http.Handler keeps
       an in-memory, mutex-guarded fixed-window counter per (route, client IP) pair: the first
       request from a client opens a window starting now; each subsequent request from the same