fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/mailer/transport.go

@@ -81,17 +81,27 @@ func (t transport) connect() (*smtp.Client, error) {
 	return client, nil
 }
 
+var errTLSUnavailable = errors.New("smtp server does not offer STARTTLS; set SMTP_ALLOW_INSECURE=true to send without encryption")
+
 func (t transport) negotiate(client *smtp.Client) error {
 	if t.settings.Port != implicitTLSPort {
-		if supported, _ := client.Extension("STARTTLS"); supported {
-			if err := client.StartTLS(t.tlsConfig); err != nil {
-				return err
-			}
+		if err := t.startTLS(client); err != nil {
+			return err
 		}
 	}
 	return t.authenticate(client)
 }
 
+func (t transport) startTLS(client *smtp.Client) error {
+	if supported, _ := client.Extension("STARTTLS"); supported {
+		return client.StartTLS(t.tlsConfig)
+	}
+	if t.settings.AllowInsecure || isLoopback(t.settings.Host) {
+		return nil
+	}
+	return errTLSUnavailable
+}
+
 func (t transport) authenticate(client *smtp.Client) error {
 	if t.settings.Login == "" {
 		return nil