security: Fix critical security vulnerabilities

- Remove secrets from Git (.env)
- Remove debug token endpoint
- Fix login to reject unauthorized access in production
- Remove HS256 fallback in JWT validation (RS256 only)
- Fix SQL injection in journal.go countQuery
- Fix CORS to use explicit origins only (no wildcard)
- Add security headers middleware (CSP, HSTS, etc.)
- Add input validation helpers
- Build successful

backend/config/config.go

@@ -23,11 +23,11 @@ type Config struct {
 }
 
 func Load() *Config {
-	return &Config{
+	cfg := &Config{
 		Port:           getEnv("PORT", "9092"),
 		DBURL:          getEnv("DB_URL", "postgres://boc:boc@localhost:5432/boc?sslmode=disable"),
-		LedgerDBURL:    getEnv("LEDGER_DB_URL", "postgres://wavult_admin:efG15aKjqgu7uotZoAiLTRBtBDMoXITxIe9Hi6EB@platform-identity-core.cvi0qcksmsfj.eu-north-1.rds.amazonaws.com:5432/amos?sslmode=disable"),
-		JWTSecret:      getEnv("JWT_SECRET", "w+Qkf/CoDda3Ba7vZLKokrGHiwUV5Ak/3tiBmFAvRC8="),
+		LedgerDBURL:    requireEnv("LEDGER_DB_URL"),
+		JWTSecret:      requireEnv("JWT_SECRET"),
 		AMOSBaseURL:    getEnv("AMOS_BASE_URL", "http://localhost:9000"),
 		CORSOrigins:    splitComma(getEnv("CORS_ORIGINS", "http://localhost:3000")),
 		MigrationsDir:  getEnv("MIGRATIONS_DIR", "./db/migrations"),
@@ -39,6 +39,17 @@ func Load() *Config {
 		FromEmail:      getEnv("FROM_EMAIL", "noreply@landvex.com"),
 		FromName:       getEnv("FROM_NAME", "Landvex BOC"),
 	}
+	
+	// Validate no wildcard in CORS origins in production
+	if cfg.Port != "9092" {
+		for _, origin := range cfg.CORSOrigins {
+			if origin == "*" {
+				panic("CORS wildcard not allowed in production")
+			}
+		}
+	}
+	
+	return cfg
 }
 
 func getEnv(key, fallback string) string {