feat: security hardening, DB indexes, token revocation, and input validation

- SSRF protection: DNS resolution + private IP blocking on metadata fetcher
- Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff
- Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at
- Attachment ownership verification before linking to messages
- Message length limit (4000 chars) enforced on client and server
- Asset URL validation on avatar/banner updates
- Federation instance validation (domain regex, origin scheme, length limits)
- DB indexes on all FK columns for query performance
- Migrations: nullable moderator columns, dm_messages reply_to FK constraint
- File cleanup on avatar/banner replacement and space deletion
- Fastify trustProxy, AbortController on fetches, typing map size cap

packages/server/src/config.ts

@@ -39,6 +39,7 @@ export const config = {
   host: env('HOST', '0.0.0.0'),
   jwtSecret: env('JWT_SECRET'),
   jwtExpiresIn: env('JWT_EXPIRES_IN', '30d'),
+  domain: envOptional('DOMAIN'),
 
   livekit: {
     url: envOptional('LIVEKIT_URL'),
@@ -51,3 +52,10 @@ export const config = {
   maxUploadSize: envInt('MAX_UPLOAD_SIZE', 104857600),
   registrationOpen: envBool('REGISTRATION_OPEN', true),
 } as const;
+
+if (config.jwtSecret.length < 32) {
+  throw new Error(
+    `JWT_SECRET must be at least 32 characters (got ${config.jwtSecret.length}). ` +
+    `Generate one with: openssl rand -hex 32`
+  );
+}