fix(security): authenticate VNC/terminal WebSockets and harden SSH/config

Critical security and robustness fixes from a code audit:

- WS terminal/VNC now require a JWT (?token=), validate the session,
  vms.console permission and VM ownership before bridging to Proxmox
  (previously the LXC terminal gave unauthenticated root shell access).
  Frontend ConsolePage passes the token in both WS URLs.
- Fix SSH fallback for `pvecm delnode`: SSHClient now supports password
  auth (it previously crashed with TypeError); ProxmoxClient stores the
  password for SSH fallbacks and the host port suffix is stripped.
- Add production startup warnings for default ADMIN_PASSWORD and wildcard
  CORS_ORIGINS.
- dashboard: use tz-aware utcnow() instead of naive datetime.utcnow().
- crypto: narrow decrypt_value except to InvalidToken and log failures.
- ssh_client: guard the shared connection cache with a lock; make
  unknown-host-key rejection opt-in via SSH_REJECT_UNKNOWN_HOSTS.
- logging: send loguru console output to stderr instead of stdout.
- Sync version fallback to 1.5.1; remove one-off refactor scripts.
- Add CODE_REVIEW.md audit report.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/main.py

@@ -37,10 +37,11 @@ def setup_logging():
     
     # Remove default logger
     logger.remove()
-    
-    # Add console logging
+
+    # Add console logging (stderr keeps logs off stdout, which may carry data)
+    import sys
     logger.add(
-        sink=lambda msg: print(msg, end=""),
+        sink=sys.stderr,
         level=settings.LOG_LEVEL,
         format="<green>{time:YYYY-MM-DD HH:mm:ss}</green> | <level>{level: <8}</level> | <cyan>{name}</cyan>:<cyan>{function}</cyan>:<cyan>{line}</cyan> - <level>{message}</level>"
     )
@@ -123,6 +124,19 @@ async def lifespan(app: FastAPI):
     if not settings.FERNET_KEY:
         logger.warning("FERNET_KEY is not set. Sensitive fields (like passwords) will be stored as plaintext.")
         logger.warning("To enable encryption, generate a key and set FERNET_KEY in your .env file.")
+
+    # Production hardening warnings (DEBUG is off in production)
+    if not settings.DEBUG:
+        if settings.ADMIN_PASSWORD == "admin123":
+            logger.warning(
+                "ADMIN_PASSWORD uses the insecure default 'admin123'. "
+                "Set a strong ADMIN_PASSWORD env var for production."
+            )
+        if settings.CORS_ORIGINS.strip() == "*":
+            logger.warning(
+                "CORS_ORIGINS is '*' (any origin). Set an explicit comma-separated "
+                "origin list (e.g. https://panel.example.com) for production."
+            )
     
     # Check database connection
     if not check_db_connection():