feat: implement security, error resilience, and query optimization proposals

Security Validation (enhance-security-validation):
- JWT secret validation with entropy checking and pattern detection
- CSRF protection middleware with token generation/validation
- Frontend CSRF token auto-injection for DELETE/PUT/PATCH requests
- MIME type validation with magic bytes detection for file uploads

Error Resilience (add-error-resilience):
- React ErrorBoundary component with fallback UI and retry functionality
- ErrorBoundaryWithI18n wrapper for internationalization support
- Page-level and section-level error boundaries in App.tsx

Query Performance (optimize-query-performance):
- Query monitoring utility with threshold warnings
- N+1 query fixes using joinedload/selectinload
- Optimized project members, tasks, and subtasks endpoints

Bug Fixes:
- WebSocket session management (P0): Return primitives instead of ORM objects
- LIKE query injection (P1): Escape special characters in search queries

Tests: 543 backend tests, 56 frontend tests passing

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

openspec/changes/archive/2026-01-11-add-error-resilience/proposal.md

@@ -0,0 +1,19 @@
+# Change: Add Frontend Error Resilience
+
+## Why
+
+QA review identified that the frontend lacks React Error Boundaries. When a render error occurs in any component, the entire application crashes with a white screen, providing no recovery path for users.
+
+## What Changes
+
+- Add React Error Boundary components around major application sections
+- Implement graceful degradation with user-friendly error messages
+- Add error reporting mechanism to capture frontend crashes
+
+## Impact
+
+- Affected specs: `dashboard`
+- Affected code:
+  - `frontend/src/components/ErrorBoundary.tsx` - New component
+  - `frontend/src/App.tsx` - Wrap routes with Error Boundaries
+  - `frontend/src/pages/` - Section-level boundaries

openspec/changes/archive/2026-01-11-add-error-resilience/specs/dashboard/spec.md

@@ -0,0 +1,24 @@
+## ADDED Requirements
+
+### Requirement: Error Boundary Protection
+The frontend application SHALL gracefully handle component render errors without crashing the entire application.
+
+#### Scenario: Component error contained
+- **WHEN** a render error occurs in a dashboard widget
+- **THEN** only that widget SHALL display an error state
+- **AND** other widgets SHALL continue to function normally
+
+#### Scenario: User-friendly error display
+- **WHEN** a component fails to render
+- **THEN** users SHALL see a friendly error message
+- **AND** users SHALL have an option to retry or report the issue
+
+#### Scenario: Error logging
+- **WHEN** a render error is caught by an Error Boundary
+- **THEN** the error details SHALL be logged for debugging
+- **AND** error context (component stack) SHALL be captured
+
+#### Scenario: Recovery option
+- **WHEN** a user sees an error fallback UI
+- **AND** the user clicks "Retry"
+- **THEN** the failed component SHALL attempt to re-render

openspec/changes/archive/2026-01-11-add-error-resilience/tasks.md

@@ -0,0 +1,14 @@
+## 1. Error Boundary Implementation
+- [x] 1.1 Create base ErrorBoundary component with fallback UI
+- [x] 1.2 Add error logging/reporting to ErrorBoundary
+- [x] 1.3 Create user-friendly error fallback designs
+
+## 2. Application Integration
+- [x] 2.1 Wrap main App routes with top-level Error Boundary
+- [x] 2.2 Add section-level boundaries around Dashboard, Tasks, Projects
+- [x] 2.3 Add component-level boundaries for complex widgets
+
+## 3. Testing
+- [x] 3.1 Write tests for ErrorBoundary component
+- [x] 3.2 Add integration tests that verify graceful degradation
+- [x] 3.3 Test error recovery flow