Security hardening

- JWT: validate signing algorithm (prevent alg confusion)
- Login: rate limiting (10 attempts per 5 min per IP)
- Request body: 10MB size limit (prevent DoS)
- WebSocket: require JWT auth (token query param or cookie)
- Daemon endpoints: require admin role (not just any user)
- io.LimitReader on all request body decoding

cmd/server/main.go

@@ -37,7 +37,9 @@ func main() {
 	// Collab WebSocket hub
 	hub := collab.NewHub(database)
 	mux := http.NewServeMux()
-	mux.Handle("/ws/collab/", http.HandlerFunc(hub.HandleWebSocket))
+	mux.Handle("/ws/collab/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hub.HandleWebSocket(w, r, secret)
+	}))
 	mux.Handle("/", router)
 
 	fmt.Printf("MarkdownHub listening on :%s\n", port)