fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

test/use_case_baseline_test.go

@@ -4,6 +4,7 @@ import (
 	"RenewCMS/internal/domain/article"
 	imageDomain "RenewCMS/internal/domain/image"
 	"RenewCMS/internal/domain/user"
+	"RenewCMS/internal/infrastructure/imaging"
 	"RenewCMS/internal/infrastructure/useCases"
 	"bytes"
 	"errors"
@@ -335,7 +336,7 @@ func TestCreateImageDelegatesContentTypeCheck(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(strings.ReplaceAll(tc.contentType, "/", "_"), func(t *testing.T) {
 			repo := newMockImageRepo()
-			uc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
+			uc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder, imaging.NewMetadataStripper())
 
 			content := []byte("fake-image-data")
 			if tc.valid {
@@ -369,7 +370,7 @@ func TestCreateImageDelegatesContentTypeCheck(t *testing.T) {
 func TestCreateImagePropagatesRepositoryFailure(t *testing.T) {
 	repo := newMockImageRepo()
 	repo.fail.failNext("Create")
-	uc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
+	uc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder, imaging.NewMetadataStripper())
 
 	_, err := uc.CreateImage(testCtx, imageDomain.ImageInput{
 		Content:     bytes.NewReader(pngBytes(t, 3, 2)),