Security hardening: CSRF, rate limiting, session/password policy, audit log

Fixes critical pre-existing issues found during review: bulk_action.php had no
auth check at all (unauthenticated download/delete of any qrcode) and built a
table name from unwhitelisted user input (SQL injection); the QR generator
classes wrote files from unvalidated filename/format, allowing path traversal
and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since
master now requires PHP 8.4, breaking the PHP 8.3 build.

- CSRF tokens on all POST forms and the bulk_action.php JSON endpoint
- Login rate limiting (5 attempts / 15 min) via new login_attempts table
- Hardened sessions: httponly/samesite cookies, 30 min idle timeout,
  session regeneration on login
- Forced password change for the default superadmin/superadmin account
- Server-side validation in Users/DynamicQrcode/Qrcode classes
- Audit log table for auth, user, and qrcode actions
- Checked-in db schema (db/init.sql, migrations/) instead of relying on an
  opaque prebuilt db image
- Production docker-compose with Nginx + php-fpm instead of the PHP dev server

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/lib/DynamicQrcode/DynamicQrcode.php

@@ -56,6 +56,8 @@ class DynamicQrcode {
      * We save into db the url of qrcode image
      */
     public function addQrcode($input_data) {
+        $this->validateLink($input_data['link'] ?? '');
+
         if($input_data['id_owner'] != "")
             $data_to_db['id_owner'] = $input_data['id_owner'];
         else
@@ -79,6 +81,8 @@ class DynamicQrcode {
      * 
      */
     public function editQrcode($input_data) {
+        $this->validateLink($input_data['link'] ?? '');
+
         if($input_data['id_owner'] != "")
             $data_to_db['id_owner'] = $input_data['id_owner'];
         else
@@ -117,6 +121,17 @@ class DynamicQrcode {
     }
 
 
+    /**
+     * Server-side validatie van de redirect-link (verplicht, max. 500 tekens per kolomdefinitie).
+     */
+    private function validateLink($link) {
+        $link = trim((string) $link);
+
+        if ($link === '' || strlen($link) > 500) {
+            $this->failure('Link is required and must be at most 500 characters.');
+        }
+    }
+
     /**
      * Flash message Failure process
      */