feat: implement 5 QA-driven security and quality proposals

Implemented proposals from comprehensive QA review:

1. extend-csrf-protection
   - Add POST to CSRF protected methods in frontend
   - Global CSRF middleware for all state-changing operations
   - Update tests with CSRF token fixtures

2. tighten-cors-websocket-security
   - Replace wildcard CORS with explicit method/header lists
   - Disable query parameter auth in production (code 4002)
   - Add per-user WebSocket connection limit (max 5, code 4005)

3. shorten-jwt-expiry
   - Reduce JWT expiry from 7 days to 60 minutes
   - Add refresh token support with 7-day expiry
   - Implement token rotation on refresh
   - Frontend auto-refresh when token near expiry (<5 min)

4. fix-frontend-quality
   - Add React.lazy() code splitting for all pages
   - Fix useCallback dependency arrays (Dashboard, Comments)
   - Add localStorage data validation in AuthContext
   - Complete i18n for AttachmentUpload component

5. enhance-backend-validation
   - Add SecurityAuditMiddleware for access denied logging
   - Add ErrorSanitizerMiddleware for production error messages
   - Protect /health/detailed with admin authentication
   - Add input length validation (comment 5000, desc 10000)

All 521 backend tests passing. Frontend builds successfully.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/models/audit_log.py

@@ -13,6 +13,8 @@ class AuditAction(str, enum.Enum):
     RESTORE = "restore"
     LOGIN = "login"
     LOGOUT = "logout"
+    ACCESS_DENIED = "access_denied"
+    AUTH_FAILED = "auth_failed"
 
 
 class SensitivityLevel(str, enum.Enum):
@@ -42,10 +44,20 @@ EVENT_SENSITIVITY = {
     "attachment.upload": SensitivityLevel.LOW,
     "attachment.download": SensitivityLevel.LOW,
     "attachment.delete": SensitivityLevel.MEDIUM,
+    # Security events
+    "security.access_denied": SensitivityLevel.MEDIUM,
+    "security.auth_failed": SensitivityLevel.MEDIUM,
+    "security.suspicious_auth_pattern": SensitivityLevel.HIGH,
 }
 
 # Events that should trigger alerts
-ALERT_EVENTS = {"project.delete", "user.permission_change", "user.admin_change", "role.permission_change"}
+ALERT_EVENTS = {
+    "project.delete",
+    "user.permission_change",
+    "user.admin_change",
+    "role.permission_change",
+    "security.suspicious_auth_pattern",
+}
 
 
 class AuditLog(Base):
@@ -57,7 +69,7 @@ class AuditLog(Base):
     resource_id = Column(String(36), nullable=True)
     user_id = Column(String(36), ForeignKey("pjctrl_users.id", ondelete="SET NULL"), nullable=True)
     action = Column(
-        Enum("create", "update", "delete", "restore", "login", "logout", name="audit_action_enum"),
+        Enum("create", "update", "delete", "restore", "login", "logout", "access_denied", "auth_failed", name="audit_action_enum"),
         nullable=False
     )
     changes = Column(JSON, nullable=True)