fix(security): authenticate VNC/terminal WebSockets and harden SSH/config

Critical security and robustness fixes from a code audit:

- WS terminal/VNC now require a JWT (?token=), validate the session,
  vms.console permission and VM ownership before bridging to Proxmox
  (previously the LXC terminal gave unauthenticated root shell access).
  Frontend ConsolePage passes the token in both WS URLs.
- Fix SSH fallback for `pvecm delnode`: SSHClient now supports password
  auth (it previously crashed with TypeError); ProxmoxClient stores the
  password for SSH fallbacks and the host port suffix is stripped.
- Add production startup warnings for default ADMIN_PASSWORD and wildcard
  CORS_ORIGINS.
- dashboard: use tz-aware utcnow() instead of naive datetime.utcnow().
- crypto: narrow decrypt_value except to InvalidToken and log failures.
- ssh_client: guard the shared connection cache with a lock; make
  unknown-host-key rejection opt-in via SSH_REJECT_UNKNOWN_HOSTS.
- logging: send loguru console output to stderr instead of stdout.
- Sync version fallback to 1.5.1; remove one-off refactor scripts.
- Add CODE_REVIEW.md audit report.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/config.py

@@ -16,7 +16,8 @@ def get_version() -> str:
     for version_file in possible_paths:
         if version_file.exists():
             return version_file.read_text().strip()
-    return "1.7.0"
+    # Fallback only if the VERSION file is missing — keep in sync with /VERSION.
+    return "1.5.1"
 
 
 class Settings(BaseSettings):
@@ -46,6 +47,10 @@ class Settings(BaseSettings):
     SSH_TIMEOUT: int = Field(default=10, env="SSH_TIMEOUT")
     DEFAULT_SSH_USER: str = Field(default="root", env="DEFAULT_SSH_USER")
     DEFAULT_SSH_PORT: int = Field(default=22, env="DEFAULT_SSH_PORT")
+    # Reject SSH connections to hosts with unknown/changed host keys (mitigates MITM).
+    # Default False preserves legacy behaviour (warn & accept); enable in production
+    # once your servers' host keys are in known_hosts.
+    SSH_REJECT_UNKNOWN_HOSTS: bool = Field(default=False, env="SSH_REJECT_UNKNOWN_HOSTS")
     
     # CORS — comma-separated list of allowed origins; "*" is insecure in production
     CORS_ORIGINS: str = Field(default="*", env="CORS_ORIGINS")