* feat: add session binding, nonce-based CSP, and auth hardening
Security hardening for Pad Cloud (PLAN-15 / TASK-171):
- Bind sessions to User-Agent hash; mismatch invalidates session
- Store client IP on session creation for audit trail
- Increase bcrypt cost from 10 to 12
- Upgrade invitation codes to 128-bit entropy with hashed storage
- Replace CSP unsafe-inline with per-request nonce for SvelteKit scripts
- Move SecurityHeaders to main router so SPA gets headers too
* fix: enforce session binding on auth cookie fallbacks and fix invitation code uniqueness
- Add validateSessionCookie() helper that checks UA binding, replacing
raw ValidateSession() calls in handleSessionCheck, handleGetCurrentUser,
and handleUpdateCurrentUser that bypassed the new session binding
- Store invitation ID in code column instead of empty string to satisfy
the NOT NULL UNIQUE constraint (previously broke on second invitation)
- Skip code/join_url in invitation listings for hashed invitations where
the plaintext is not recoverable
xarmian