chore: root commit of OWSAP security testing/tightening

.env.example

@@ -4,6 +4,7 @@ PORT=8080
 CORS_ORIGIN=http://localhost:5173
 CORS_ORIGINS=http://localhost:5173,http://127.0.0.1:5173,https://skymoneybudget.com
 AUTH_DISABLED=false
+ALLOW_INSECURE_AUTH_FOR_DEV=false
 SEED_DEFAULT_BUDGET=false
 ROLLOVER_SCHEDULE_CRON=0 6 * * *
 APP_ORIGIN=http://localhost:5173
@@ -21,8 +22,12 @@ ADMIN_DATABASE_URL=postgres://postgres:change-me@127.0.0.1:5432/postgres
 
 # Auth secrets (min 32 chars)
 JWT_SECRET=replace-with-32+-chars
+JWT_ISSUER=skymoney-api
+JWT_AUDIENCE=skymoney-web
 COOKIE_SECRET=replace-with-32+-chars
 COOKIE_DOMAIN=skymoneybudget.com
+AUTH_MAX_FAILED_ATTEMPTS=5
+AUTH_LOCKOUT_WINDOW_MS=900000
 
 # Email (verification + delete confirmation)
 SMTP_HOST=smtp.example.com