fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/useCases/ExportActivity.go

@@ -11,7 +11,7 @@ import (
 const exportBatchSize = 500
 
 const formulaGuard = "'"
-const formulaStarts = "=+-@"
+const formulaStarts = "=+-@\t\r"
 
 var exportHeader = []string{"when", "actor", "action", "target", "outcome", "source", "ip"}