feat: implement security, error resilience, and query optimization proposals

Security Validation (enhance-security-validation):
- JWT secret validation with entropy checking and pattern detection
- CSRF protection middleware with token generation/validation
- Frontend CSRF token auto-injection for DELETE/PUT/PATCH requests
- MIME type validation with magic bytes detection for file uploads

Error Resilience (add-error-resilience):
- React ErrorBoundary component with fallback UI and retry functionality
- ErrorBoundaryWithI18n wrapper for internationalization support
- Page-level and section-level error boundaries in App.tsx

Query Performance (optimize-query-performance):
- Query monitoring utility with threshold warnings
- N+1 query fixes using joinedload/selectinload
- Optimized project members, tasks, and subtasks endpoints

Bug Fixes:
- WebSocket session management (P0): Return primitives instead of ORM objects
- LIKE query injection (P1): Escape special characters in search queries

Tests: 543 backend tests, 56 frontend tests passing

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/services/notification_service.py

@@ -14,6 +14,7 @@ from sqlalchemy import event
 from app.models import User, Notification, Task, Comment, Mention
 from app.core.redis_pubsub import publish_notification as redis_publish, get_channel_name
 from app.core.redis import get_redis_sync
+from app.core.database import escape_like
 
 logger = logging.getLogger(__name__)
 
@@ -427,9 +428,12 @@ class NotificationService:
 
         # Find users by email or name
         for username in mentioned_usernames:
+            # Escape special LIKE characters to prevent injection
+            escaped_username = escape_like(username)
             # Try to find user by email first
             user = db.query(User).filter(
-                (User.email.ilike(f"{username}%")) | (User.name.ilike(f"%{username}%"))
+                (User.email.ilike(f"{escaped_username}%", escape="\\")) |
+                (User.name.ilike(f"%{escaped_username}%", escape="\\"))
             ).first()
 
             if user and user.id != author.id: