security: remediate all P0-P2 audit findings (12 tasks)

P0 fixes:
- WebSocket origin checking (reject untrusted origins)
- WS session token moved from URL query param to first message frame
- WebAuthn login cookie now uses Secure flag via shared SetSessionCookie
- PostgreSQL sslmode configurable via POSTGRES_SSLMODE env (default: require)
- Fixed DatabaseDSN to use real password instead of masked placeholder

P1 fixes:
- Per-IP rate limiting middleware (auth: 5 req/s, invites: 2 req/s)
- Security headers on all responses (CSP, X-Frame-Options, nosniff, etc.)
- WS broadcasts scoped to server members (prevents cross-server data leak)
- Webhook tokens stored as SHA-256 hashes (not plaintext)

P2 fixes:
- CSRF protection via Origin header validation on state-changing requests
- MANAGE_CHANNELS permission enforced on channel update/delete
- Upload validation: 25MB limit, extension allowlist, server-side MIME check
- File serve: path traversal protection + Content-Disposition: attachment

Files: 23 changed, +499/-100. Builds clean (go build, go vet, npm build).
Zero CVEs (govulncheck, npm audit).

internal/config/config.go

@@ -25,6 +25,7 @@ type DatabaseConfig struct {
 	User     string
 	Password string
 	Database string
+	SSLMode  string
 }
 
 type ValkeyConfig struct {
@@ -70,6 +71,7 @@ func Load() *Config {
 			User:     getEnv("POSTGRES_USER", "dumpster"),
 			Password: getEnv("POSTGRES_PASSWORD", "dumpster"),
 			Database: getEnv("POSTGRES_DB", "dumpster"),
+			SSLMode:  getEnv("POSTGRES_SSLMODE", "require"),
 		},
 		Valkey: ValkeyConfig{
 			URL: getEnv("VALKEY_URL", "redis://localhost:***@example.com"),
@@ -92,7 +94,7 @@ func Load() *Config {
 }
 
 func (c *Config) DatabaseDSN() string {
-	return "postgres://" + c.Database.User + ":***@" + c.Database.Host + ":" + c.Database.Port + "/" + c.Database.Database + "?sslmode=disable"
+	return "postgres://" + c.Database.User + ":" + c.Database.Password + "@" + c.Database.Host + ":" + c.Database.Port + "/" + c.Database.Database + "?sslmode=" + c.Database.SSLMode
 }
 
 func getEnv(key, fallback string) string {