security: fix critical vulnerabilities and code quality issues

Critical fixes:
- init_admin.py: replace hardcoded admin123 password with ADMIN_PASSWORD env var
- proxmox_client.py, models.py: change verify_ssl default from False to True
- api/proxmox.py: use server.verify_ssl instead of hardcoded verify=False in websocket handler
- ssh_client.py: replace AutoAddPolicy (MITM-vulnerable) with WarningPolicy + load_system_host_keys

Security hardening:
- main.py: add security headers middleware (CSP, X-Frame-Options, HSTS, X-XSS-Protection, Referrer-Policy)
- main.py: fix CORS — allow_credentials=True is incompatible with allow_origins=["*"]; read origins from CORS_ORIGINS env var
- auth.py, logging_middleware.py: validate X-Forwarded-For/X-Real-IP to prevent IP spoofing

Performance:
- monitoring_worker.py: wire up cleanup_expired_connections() as hourly scheduled job (was defined but never called)

Code quality:
- logging_service.py: move `import json` from inside function to module level
- ssh_client.py, proxmox_client.py, api/proxmox.py, rbac/migration.py, task_queue_service.py: replace all bare `except:` with `except Exception:`
- .env.example, config.py: document ADMIN_PASSWORD and CORS_ORIGINS settings

https://claude.ai/code/session_019rK2wvaWg5zXFwmAPPEB7R

backend/app/auth.py

@@ -179,22 +179,35 @@ def require_permission(user: User, permission: str) -> None:
     PermissionEngine.check_permission(user, permission)
 
 
+def _validate_ip(ip: str) -> bool:
+    """Return True if ip is a valid IPv4 or IPv6 address."""
+    import ipaddress
+    try:
+        ipaddress.ip_address(ip)
+        return True
+    except ValueError:
+        return False
+
+
 def get_client_ip(request: Request) -> str:
-    """Get client IP from request, handling proxies"""
-    # Try X-Forwarded-For first (from nginx/proxy)
+    """Get client IP from request, handling proxies.
+
+    Only X-Forwarded-For / X-Real-IP values that parse as valid IP addresses
+    are trusted, preventing header-injection / IP-spoofing attacks.
+    """
     forwarded = request.headers.get("x-forwarded-for")
     if forwarded:
-        return forwarded.split(",")[0].strip()
-    
-    # Try X-Real-IP
-    real_ip = request.headers.get("x-real-ip")
-    if real_ip:
+        candidate = forwarded.split(",")[0].strip()
+        if _validate_ip(candidate):
+            return candidate
+
+    real_ip = request.headers.get("x-real-ip", "").strip()
+    if real_ip and _validate_ip(real_ip):
         return real_ip
-    
-    # Fall back to direct client
+
     if request.client:
         return request.client.host
-    
+
     return "unknown"