fix: comprehensive system audit fixes (55+ issues)

CRITICAL:
- Fix SQL injection in prestart.sh (parameterized query)
- Fix secret key validation (always validate, not just production)
- Fix workspace model partial index bug (func.text -> text)
- Fix HealthResponse schema (add checks field)
- Fix Tenant import in permissions.py (NameError on every auth request)
- Fix README tech stack (React instead of Alpine.js)
- Delete broken test_cross_tenant_security_v2.py
- Add fail-closed RLS migration 0084 (48 tenant tables)

HIGH:
- Add GeneralRateLimitMiddleware for all API routes
- Add file type blocklist for DMS and attachment uploads
- Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass
- Fix CSRF bypass path matching (in -> endswith)
- Add worker healthcheck in docker-compose.yml
- Add ARQ max_tries=3 for job retries
- Fix 28 bare pass in mail services (-> logger.debug)
- Fix print() -> logger in main.py and ai_assistant
- Fix duplicate email handling (catch IntegrityError -> 409)
- Add session revocation (invalidate_all_user_sessions)
- Add resource limits to all containers
- Fix CORS default (localhost -> production domain)
- Fix SameSite=Lax -> Strict
- Fix Redis password visibility in healthcheck
- Fix npm vulnerabilities (19 -> 9)
- Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP)

MEDIUM:
- Localize ErrorBoundary to German
- Wire Mail.tsx save/delete filter to API
- Document system_notif plugin (no routes needed)
- Fix datetime.utcnow() -> datetime.now(UTC)
- Pin litellm version (>=1.0,<2.0)
- Move CSRF token from sessionStorage to in-memory
- Fix restore_backup error handling and transaction
- Fix Dms.tsx useEffect cleanup
- Add skip-to-content link for accessibility
- Add selectinload imports to 3 services
- Add .env.example missing variables
- Fix AppShell/TopBar/Sidebar test mocks

NEW TESTS:
- test_guest_auth.py (6 tests)
- test_user_service.py (8 tests)
- test_backup_service.py (5 tests)

NEW SCHEMAS:
- saved_filter, saved_view, user_preference, workspace, entity_policy

Tests: 22/22 PASSED

app/config.py

@@ -36,7 +36,7 @@ class Settings(BaseSettings):
     bcrypt_rounds: int = 12
     session_cookie_name: str = "leocrm_session"
     session_cookie_secure: bool = True  # Secure by default — set to False only for local HTTP development
-    session_cookie_samesite: str = "lax"  # Lax allows WebSocket cookies; Strict blocks them
+    session_cookie_samesite: str = "strict"  # Strict blocks WebSocket cookies; use Lax only if WS needed
     session_cookie_httponly: bool = True
     password_reset_expiry_hours: int = 1
 
@@ -83,12 +83,16 @@ class Settings(BaseSettings):
 def get_settings() -> Settings:
     """Get cached settings instance."""
     s = Settings()
-    # Production safety checks
+    # Safety checks — always validate critical settings
+    _DEFAULT_KEY = "change-me-in-production-use-a-secure-random-string"
+    if s.secret_key == _DEFAULT_KEY:
+        raise RuntimeError("SECRET_KEY must be changed from default value")
+    if len(s.secret_key) < 32:
+        raise RuntimeError("SECRET_KEY must be at least 32 characters long")
+    # Production-only checks
     if s.environment == "production":
         if not s.session_cookie_secure:
             raise RuntimeError("SESSION_COOKIE_SECURE must be True in production")
-        if s.secret_key == "change-me-in-production-use-a-secure-random-string":
-            raise RuntimeError("SECRET_KEY must be changed from default in production")
         if s.storage_path == "/tmp":
             raise RuntimeError("STORAGE_PATH must not be /tmp in production")
     return s