fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

test/activity_usecases_test.go

@@ -370,6 +370,8 @@ func TestActivityExportUseCase(t *testing.T) {
 			{"target", "+1+1", "'+1+1"},
 			{"target", "-2", "'-2"},
 			{"actor", "@SUM(A1)", "'@SUM(A1)"},
+			{"target", "\t=cmd", "'\t=cmd"},
+			{"target", "\r=cmd", "'\r=cmd"},
 			{"target", "Spring release", "Spring release"},
 			{"target", "a=b", "a=b"},
 		}