security: QA Council audit fixes

- Remove JWT secret fallbacks (fail on startup if missing)
- Hash refresh tokens with SHA-256 before DB storage
- Add Zod validation to bulk-approve, bulk-reject, update-user, copy-week
- Add global API rate limiting (100 req/15min per IP)
- Fix nginx X-XSS-Protection header (align with Helmet)
- Remove --accept-data-loss from Dockerfile CMD
- Create .gitignore to protect secrets from commits
- Secure .env file permissions (chmod 600)

backend/src/routes/entries.js

@@ -4,6 +4,7 @@ const {
   createEntrySchema,
   updateEntrySchema,
   weekQuerySchema,
+  copyWeekSchema,
   validateBody,
   validateQuery,
 } = require('../utils/validation');
@@ -269,12 +270,9 @@ router.delete('/:id', async (req, res) => {
 });
 
 // ─────────────── POST /api/entries/copy-week ───────────────
-router.post('/copy-week', async (req, res) => {
+router.post('/copy-week', validateBody(copyWeekSchema), async (req, res) => {
   try {
-    const { fromWeek, toWeek } = req.body;
-    if (!fromWeek || !toWeek) {
-      return res.status(400).json({ error: 'fromWeek and toWeek are required (YYYY-MM-DD Monday)' });
-    }
+    const { fromWeek, toWeek } = req.validated;
 
     const fromMonday = getWeekMonday(fromWeek);
     const toMonday = getWeekMonday(toWeek);