fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/domain/image/metadataStripper.go

@@ -0,0 +1,5 @@
+package image
+
+type MetadataStripper interface {
+	Strip(contentType string, data []byte) ([]byte, error)
+}