feat: implement security, error resilience, and query optimization proposals

Security Validation (enhance-security-validation):
- JWT secret validation with entropy checking and pattern detection
- CSRF protection middleware with token generation/validation
- Frontend CSRF token auto-injection for DELETE/PUT/PATCH requests
- MIME type validation with magic bytes detection for file uploads

Error Resilience (add-error-resilience):
- React ErrorBoundary component with fallback UI and retry functionality
- ErrorBoundaryWithI18n wrapper for internationalization support
- Page-level and section-level error boundaries in App.tsx

Query Performance (optimize-query-performance):
- Query monitoring utility with threshold warnings
- N+1 query fixes using joinedload/selectinload
- Optimized project members, tasks, and subtasks endpoints

Bug Fixes:
- WebSocket session management (P0): Return primitives instead of ORM objects
- LIKE query injection (P1): Escape special characters in search queries

Tests: 543 backend tests, 56 frontend tests passing

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/api/auth/router.py

@@ -8,7 +8,7 @@ from app.core.redis import get_redis
 from app.core.rate_limiter import limiter
 from app.models.user import User
 from app.models.audit_log import AuditAction
-from app.schemas.auth import LoginRequest, LoginResponse, UserInfo
+from app.schemas.auth import LoginRequest, LoginResponse, UserInfo, CSRFTokenResponse
 from app.services.auth_client import (
     verify_credentials,
     AuthAPIError,
@@ -16,6 +16,7 @@ from app.services.auth_client import (
 )
 from app.services.audit_service import AuditService
 from app.middleware.auth import get_current_user
+from app.middleware.csrf import get_csrf_token_for_user
 
 router = APIRouter()
 
@@ -182,3 +183,23 @@ async def get_current_user_info(
         department_id=current_user.department_id,
         is_system_admin=current_user.is_system_admin,
     )
+
+
+@router.get("/csrf-token", response_model=CSRFTokenResponse)
+async def get_csrf_token(
+    current_user: User = Depends(get_current_user),
+):
+    """
+    Get a CSRF token for the current user.
+
+    The CSRF token should be included in the X-CSRF-Token header
+    for all sensitive state-changing operations (DELETE, PUT, PATCH).
+
+    Token expires after 1 hour and should be refreshed.
+    """
+    csrf_token = get_csrf_token_for_user(current_user.id)
+
+    return CSRFTokenResponse(
+        csrf_token=csrf_token,
+        expires_in=3600,  # 1 hour
+    )