security: Fix critical security vulnerabilities

- Remove secrets from Git (.env)
- Remove debug token endpoint
- Fix login to reject unauthorized access in production
- Remove HS256 fallback in JWT validation (RS256 only)
- Fix SQL injection in journal.go countQuery
- Fix CORS to use explicit origins only (no wildcard)
- Add security headers middleware (CSP, HSTS, etc.)
- Add input validation helpers
- Build successful

backend/middleware/validation.go

@@ -6,10 +6,71 @@ import (
 	"fmt"
 	"net/http"
 	"reflect"
+	"regexp"
 	"strconv"
 	"strings"
 )
 
+var (
+	emailRegex = regexp.MustCompile(`^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$`)
+	uuidRegex  = regexp.MustCompile(`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`)
+)
+
+// ValidateEmail kontrollerar email-format
+func IsValidEmail(email string) bool {
+	return emailRegex.MatchString(email)
+}
+
+// ValidateUUID kontrollerar UUID-format (legacy alias)
+func ValidateUUID(uuid string) bool {
+	return uuidRegex.MatchString(uuid)
+}
+
+// ValidateEmail kontrollerar email-format (legacy alias)
+func ValidateEmail(email string) bool {
+	return emailRegex.MatchString(email)
+}
+
+// ValidatePhone kontrollerar telefonnummer
+func ValidatePhone(phone string) bool {
+	// Tillåt +, siffror, mellanslag och bindestreck
+	cleaned := strings.ReplaceAll(phone, " ", "")
+	cleaned = strings.ReplaceAll(cleaned, "-", "")
+	return len(cleaned) >= 8 && len(cleaned) <= 15
+}
+
+// ValidateOrgNumber kontrollerar svenskt organisationsnummer
+func ValidateOrgNumber(org string) bool {
+	// Ta bort mellanslag och bindestreck
+	cleaned := strings.ReplaceAll(org, " ", "")
+	cleaned = strings.ReplaceAll(cleaned, "-", "")
+	
+	if len(cleaned) != 10 {
+		return false
+	}
+	
+	// Kontrollera att det bara är siffror
+	for _, c := range cleaned {
+		if c < '0' || c > '9' {
+			return false
+		}
+	}
+	
+	return true
+}
+
+// SanitizeString tar bort farliga tecken från strängar
+func SanitizeString(s string) string {
+	// Ta bort null bytes och kontrolltecken
+	var result strings.Builder
+	for _, r := range s {
+		if r >= 32 || r == '\t' || r == '\n' || r == '\r' {
+			result.WriteRune(r)
+		}
+	}
+	return strings.TrimSpace(result.String())
+}
+
 // ── Request Validation ────────────────────────────────────────────────────
 
 type Validator struct {
@@ -63,7 +124,7 @@ func (v *Validator) ValidateEmail(field, value string, required bool) {
 		return
 	}
 	
-	if value != "" && !ValidateEmail(value) {
+	if value != "" && !IsValidEmail(value) {
 		v.AddError(field, "invalid email format")
 	}
 }