Security audit fixes, mobile responsiveness across 40+ admin pages

Security hardening from Mar 31 audit:
- Separate login rate limit (10/15min) from general auth budget (15/15min)
- Timing-safe webhook secret comparison (Listmonk)
- Docs file creation ACL check (matches PUT/DELETE guards)
- Key separation warnings for GITEA_SSO_SECRET and SERVICE_PASSWORD_SALT
- Clear GITEA_ADMIN_PASSWORD from .env after auto-setup
- SQL injection prevention in effectiveness groupBy (pre-validated map)
- Token hashing for password reset and verification tokens

Mobile responsiveness (Phase 2C):
- Add MobilePageHeader component and useMobile hook
- Responsive table columns (hide secondary cols on mobile)
- scroll={{ x: 'max-content' }} across all data tables
- Mobile-adapted layouts for Dashboard, Settings, Calendar, SMS, Social pages
- Conditional toolbar buttons on mobile viewports

Infrastructure:
- Updated docker-compose and nginx templates
- Build script and mirror script updates

Bunker Admin

api/src/config/env.ts

@@ -38,9 +38,9 @@ const envSchema = z.object({
   // Encryption (for DB-stored secrets like SMTP password — required for all environments)
   ENCRYPTION_KEY: z.string().min(32, 'ENCRYPTION_KEY must be at least 32 characters'),
 
-  // Gitea SSO cookie signing secret (falls back to JWT_ACCESS_SECRET if empty)
+  // Gitea SSO cookie signing secret — MUST be unique (key separation from JWT)
   GITEA_SSO_SECRET: z.string().default(''),
-  // Salt for deriving deterministic service passwords (Gitea, Rocket.Chat — falls back to JWT_ACCESS_SECRET if empty)
+  // Salt for deriving deterministic service passwords (Gitea, Rocket.Chat) — MUST be unique
   SERVICE_PASSWORD_SALT: z.string().default(''),
 
   // Initial Super Admin (auto-created during database seeding)
@@ -259,7 +259,17 @@ function validateEnv(): Env {
     console.error(result.error.flatten().fieldErrors);
     process.exit(1);
   }
-  return result.data;
+
+  // Warn about security-critical key separation issues
+  const data = result.data;
+  if (!data.GITEA_SSO_SECRET) {
+    console.warn('⚠ SECURITY WARNING: GITEA_SSO_SECRET is empty — falling back to JWT_ACCESS_SECRET. This violates key separation. Generate a unique secret with: openssl rand -hex 32');
+  }
+  if (!data.SERVICE_PASSWORD_SALT) {
+    console.warn('⚠ SECURITY WARNING: SERVICE_PASSWORD_SALT is empty — falling back to JWT_ACCESS_SECRET. Rotating JWT_ACCESS_SECRET will invalidate all provisioned service passwords. Generate a unique salt with: openssl rand -hex 32');
+  }
+
+  return data;
 }
 
 export const env = validateEnv();