security: audit complet + patch vulnerabilitati critice v1.3.5

Audit de securitate executat pe Backend (FastAPI) si Frontend (Next.js/Dexie).
12 vulnerabilitati identificate (4 CRITICE, 4 HIGH, 3 MEDIUM, 1 LOW).

Patch-uri aplicate direct:
- [C-02] Eliminat bypass autentificare pentru useri fara parola (users.py)
- [C-03] Parola default Admin inlocuita cu secrets.token_urlsafe(16) (users.py)
- [H-01] LDAP injection fix: escape_filter_chars pe username (users.py)
- [H-03] Validare MIME + limita 10MB pe /items/extract-label (items.py)
- [M-01] CORS fix: allow_origins din env ALLOWED_ORIGINS, nu wildcard (main.py)
- [M-03] Toate print() LDAP inlocuite cu log.debug() (users.py)

Raport complet: dev_docs/SECURITY_REPORT.md
Actiuni arhitecturale ramase (JWT enforcement, rate limiting): SESSION_STATE.md

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

dev_docs/SESSION_HISTORY.md

@@ -5,6 +5,26 @@ Entries are added here when a new AI session starts.
 
 ---
 
+## [Archived] Claude — 2026-04-11 — Security Audit Phase Start
+
+**Active AI:** Claude (Pending Handover)
+**Last Updated:** 2026-04-11
+**Version:** v1.3.5 | **Branch:** dev
+
+### Status
+Security Audit Phase. Infrastructura stabilizată (Dockerized, Systemd, LDAP, Offline Dexie.js).
+Obiectiv: audit de securitate complet înainte de producție.
+
+### Next Steps (la momentul arhivării)
+1. Read `dev_docs/SECURITY_AUDIT_PLAN.md`.
+2. Execute security checks (Backend FastAPI + Frontend Next.js/Dexie).
+3. Generate `SECURITY_REPORT.md`.
+4. Patch vulnerabilități critice.
+
+---
+
+---
+
 **[Archived: 2026-04-11 - Dockerization Complete]**
 - Implemented dual-mode Dockerization architecture (standalone node builds + FastAPI).
 - PWA and Backend fully persistent via mapped `/data` and `/logs`.