security: fix critical vulnerabilities and code quality issues

Critical fixes:
- init_admin.py: replace hardcoded admin123 password with ADMIN_PASSWORD env var
- proxmox_client.py, models.py: change verify_ssl default from False to True
- api/proxmox.py: use server.verify_ssl instead of hardcoded verify=False in websocket handler
- ssh_client.py: replace AutoAddPolicy (MITM-vulnerable) with WarningPolicy + load_system_host_keys

Security hardening:
- main.py: add security headers middleware (CSP, X-Frame-Options, HSTS, X-XSS-Protection, Referrer-Policy)
- main.py: fix CORS — allow_credentials=True is incompatible with allow_origins=["*"]; read origins from CORS_ORIGINS env var
- auth.py, logging_middleware.py: validate X-Forwarded-For/X-Real-IP to prevent IP spoofing

Performance:
- monitoring_worker.py: wire up cleanup_expired_connections() as hourly scheduled job (was defined but never called)

Code quality:
- logging_service.py: move `import json` from inside function to module level
- ssh_client.py, proxmox_client.py, api/proxmox.py, rbac/migration.py, task_queue_service.py: replace all bare `except:` with `except Exception:`
- .env.example, config.py: document ADMIN_PASSWORD and CORS_ORIGINS settings

https://claude.ai/code/session_019rK2wvaWg5zXFwmAPPEB7R

backend/app/rbac/migration.py

@@ -328,7 +328,7 @@ def migrate_all_roles_to_new_format(conn) -> int:
         if isinstance(permissions, str):
             try:
                 permissions = json.loads(permissions)
-            except:
+            except Exception:
                 continue
         
         # Check if already migrated (has : in keys)
@@ -382,7 +382,7 @@ def ensure_default_roles_new_format(conn) -> None:
             if isinstance(current_perms, str):
                 try:
                     current_perms = json.loads(current_perms)
-                except:
+                except Exception:
                     current_perms = {}
             
             # Check if needs update