Security hardening: JWT algorithm pinning, key separation, injection fixes

- Pin HS256 algorithm on all jwt.verify() calls (9 sites) and jwt.sign()
  calls (3 sites) — prevents algorithm confusion attacks
- Add JWT_INVITE_SECRET env var; volunteer invite tokens now use a
  dedicated key separate from access/refresh secrets
- Remove req.query.secret fallback from Listmonk webhook route — secrets
  must not appear in nginx access logs
- Replace child_process.spawn in email template seed endpoint with direct
  function import; add require.main guard to seed script
- Add sanitizeCsvField() to location CSV export to prevent formula
  injection in Excel/Sheets (=, +, -, @ prefix → apostrophe prefix)
- Cap QR endpoint text input at 2000 chars to prevent DoS via large payloads
- Fix pre-existing TS errors: type participantNeeds as UpsertNeedsInput
  in meeting-planner service; add sso field to UpdateResourcePayload

Bunker Admin

.env.example

@@ -29,6 +29,7 @@ V2_POSTGRES_PORT=5433
 # --- JWT Auth ---
 JWT_ACCESS_SECRET=GENERATE_WITH_openssl_rand_hex_32
 JWT_REFRESH_SECRET=GENERATE_WITH_openssl_rand_hex_32
+JWT_INVITE_SECRET=GENERATE_WITH_openssl_rand_hex_32
 JWT_ACCESS_EXPIRY=15m
 JWT_REFRESH_EXPIRY=7d