feat: implement security enhancements (task 17)

- Add rate limiting for login, registration, and invitations
- Implement CSRF protection with SameSite cookies and security headers
- Configure secure session cookies with httpOnly and secure flags
- Enhance input sanitization for XSS and injection prevention
- Add comprehensive security tests (41 tests passing)
- Document security enhancements in SECURITY_ENHANCEMENTS.md

Requirements: 9.3, 9.4, 9.5

auth.ts

@@ -16,6 +16,17 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
     maxAge: 30 * 24 * 60 * 60, // 30 days in seconds
     updateAge: 24 * 60 * 60, // Update session every 24 hours
   },
+  cookies: {
+    sessionToken: {
+      name: `${process.env.NODE_ENV === 'production' ? '__Secure-' : ''}next-auth.session-token`,
+      options: {
+        httpOnly: true, // Prevent JavaScript access to cookies (XSS protection)
+        sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests
+        path: '/',
+        secure: process.env.NODE_ENV === 'production', // Only send cookie over HTTPS in production
+      },
+    },
+  },
   providers: [
     Credentials({
       name: "credentials",