security: remediate all P0-P2 audit findings (12 tasks)

P0 fixes:
- WebSocket origin checking (reject untrusted origins)
- WS session token moved from URL query param to first message frame
- WebAuthn login cookie now uses Secure flag via shared SetSessionCookie
- PostgreSQL sslmode configurable via POSTGRES_SSLMODE env (default: require)
- Fixed DatabaseDSN to use real password instead of masked placeholder

P1 fixes:
- Per-IP rate limiting middleware (auth: 5 req/s, invites: 2 req/s)
- Security headers on all responses (CSP, X-Frame-Options, nosniff, etc.)
- WS broadcasts scoped to server members (prevents cross-server data leak)
- Webhook tokens stored as SHA-256 hashes (not plaintext)

P2 fixes:
- CSRF protection via Origin header validation on state-changing requests
- MANAGE_CHANNELS permission enforced on channel update/delete
- Upload validation: 25MB limit, extension allowlist, server-side MIME check
- File serve: path traversal protection + Content-Disposition: attachment

Files: 23 changed, +499/-100. Builds clean (go build, go vet, npm build).
Zero CVEs (govulncheck, npm audit).

internal/db/db.go

@@ -185,6 +185,10 @@ CREATE INDEX IF NOT EXISTS idx_slash_commands_server ON slash_commands(server_id
 CREATE INDEX IF NOT EXISTS idx_webhooks_channel ON webhooks(channel_id);
 CREATE INDEX IF NOT EXISTS idx_webhooks_token ON webhooks(token);
 
+-- Add token_hash column for secure webhook token storage
+ALTER TABLE webhooks ADD COLUMN IF NOT EXISTS token_hash VARCHAR(64);
+CREATE INDEX IF NOT EXISTS idx_webhooks_token_hash ON webhooks(token_hash);
+
 CREATE TABLE IF NOT EXISTS push_subscriptions (
 	id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
 	user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,