security: Fix critical security vulnerabilities

- Remove secrets from Git (.env)
- Remove debug token endpoint
- Fix login to reject unauthorized access in production
- Remove HS256 fallback in JWT validation (RS256 only)
- Fix SQL injection in journal.go countQuery
- Fix CORS to use explicit origins only (no wildcard)
- Add security headers middleware (CSP, HSTS, etc.)
- Add input validation helpers
- Build successful

backend/handlers/journal.go

@@ -112,20 +112,27 @@ func (h *JournalHandler) GetJournalEntries(w http.ResponseWriter, r *http.Reques
 		entries = append(entries, e)
 	}
 
-	// Hämta total count
+	// Hämta total count med parameterized queries
 	var total int
 	countQuery := `SELECT COUNT(*) FROM journal_entries WHERE 1=1`
+	countArgs := []interface{}{}
+	countArgCount := 0
+	
 	if accountFilter != "" {
+		countArgCount++
 		countQuery += ` AND EXISTS (
 			SELECT 1 FROM journal_lines jl 
 			JOIN accounts a ON jl.account_id = a.id 
-			WHERE jl.journal_entry_id = journal_entries.id AND a.code = '` + accountFilter + `'
+			WHERE jl.journal_entry_id = journal_entries.id AND a.code = $` + strconv.Itoa(countArgCount) + `
 		)`
+		countArgs = append(countArgs, accountFilter)
 	}
 	if periodFilter != "" {
-		countQuery += ` AND period = '` + periodFilter + `'`
+		countArgCount++
+		countQuery += ` AND period = $` + strconv.Itoa(countArgCount)
+		countArgs = append(countArgs, periodFilter)
 	}
-	h.ledgerDB.QueryRow(countQuery).Scan(&total)
+	h.ledgerDB.QueryRow(countQuery, countArgs...).Scan(&total)
 
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]interface{}{