fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

test/container_update_guidance_http_test.go

@@ -79,6 +79,7 @@ func TestContainerUpdateGuidanceHTTP(t *testing.T) {
 		}{{"true", true}, {"TRUE", true}, {"false", false}, {"", false}, {"yes", false}}
 		for _, tc := range cases {
 			t.Run("value "+tc.value, func(t *testing.T) {
+				t.Setenv("JWT_SECRET", testJWTSecret)
 				t.Setenv("SMTP_PORT", "1")
 				t.Setenv("AUTH_RATE_LIMIT_MAX_ATTEMPTS", "1")
 				t.Setenv("AUTH_RATE_LIMIT_WINDOW_SECONDS", "1")