Security hardening: JWT algorithm pinning, key separation, injection fixes

- Pin HS256 algorithm on all jwt.verify() calls (9 sites) and jwt.sign()
  calls (3 sites) — prevents algorithm confusion attacks
- Add JWT_INVITE_SECRET env var; volunteer invite tokens now use a
  dedicated key separate from access/refresh secrets
- Remove req.query.secret fallback from Listmonk webhook route — secrets
  must not appear in nginx access logs
- Replace child_process.spawn in email template seed endpoint with direct
  function import; add require.main guard to seed script
- Add sanitizeCsvField() to location CSV export to prevent formula
  injection in Excel/Sheets (=, +, -, @ prefix → apostrophe prefix)
- Cap QR endpoint text input at 2000 chars to prevent DoS via large payloads
- Fix pre-existing TS errors: type participantNeeds as UpsertNeedsInput
  in meeting-planner service; add sso field to UpdateResourcePayload

Bunker Admin

api/src/services/listmonk-proxy.service.ts

@@ -82,7 +82,7 @@ export function startProxy(): http.Server {
       }
 
       try {
-        const payload = jwt.verify(token, env.JWT_ACCESS_SECRET) as {
+        const payload = jwt.verify(token, env.JWT_ACCESS_SECRET, { algorithms: ['HS256'] }) as {
           id: string;
           role: UserRole;
           roles?: UserRole[];

api/src/services/pangolin.client.ts

@@ -110,6 +110,7 @@ export interface UpdateResourcePayload {
   subdomain?: string;
   fullDomain?: string;
   ssl?: boolean;
+  sso?: boolean;
   active?: boolean;
   blockAccess?: boolean;
   proxyPort?: number;