fix(security): authenticate VNC/terminal WebSockets and harden SSH/config

Critical security and robustness fixes from a code audit:

- WS terminal/VNC now require a JWT (?token=), validate the session,
  vms.console permission and VM ownership before bridging to Proxmox
  (previously the LXC terminal gave unauthenticated root shell access).
  Frontend ConsolePage passes the token in both WS URLs.
- Fix SSH fallback for `pvecm delnode`: SSHClient now supports password
  auth (it previously crashed with TypeError); ProxmoxClient stores the
  password for SSH fallbacks and the host port suffix is stripped.
- Add production startup warnings for default ADMIN_PASSWORD and wildcard
  CORS_ORIGINS.
- dashboard: use tz-aware utcnow() instead of naive datetime.utcnow().
- crypto: narrow decrypt_value except to InvalidToken and log failures.
- ssh_client: guard the shared connection cache with a lock; make
  unknown-host-key rejection opt-in via SSH_REJECT_UNKNOWN_HOSTS.
- logging: send loguru console output to stderr instead of stdout.
- Sync version fallback to 1.5.1; remove one-off refactor scripts.
- Add CODE_REVIEW.md audit report.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/crypto.py

@@ -56,8 +56,15 @@ def decrypt_value(value: str) -> str:
         return value
     try:
         return f.decrypt(value.encode()).decode()
-    except (InvalidToken, Exception):
-        # Value is likely plaintext (pre-encryption legacy row)
+    except InvalidToken:
+        # Value is likely plaintext (pre-encryption legacy row) or was
+        # encrypted with a different FERNET_KEY. Return as-is for backward
+        # compatibility, but warn so key-rotation mistakes are visible.
+        logger.warning(
+            "Fernet decryption failed (InvalidToken). Value returned as-is — "
+            "this is expected for legacy plaintext rows, but check FERNET_KEY "
+            "if previously-encrypted data is now unreadable."
+        )
         return value