security: fix critical vulnerabilities and code quality issues

Critical fixes:
- init_admin.py: replace hardcoded admin123 password with ADMIN_PASSWORD env var
- proxmox_client.py, models.py: change verify_ssl default from False to True
- api/proxmox.py: use server.verify_ssl instead of hardcoded verify=False in websocket handler
- ssh_client.py: replace AutoAddPolicy (MITM-vulnerable) with WarningPolicy + load_system_host_keys

Security hardening:
- main.py: add security headers middleware (CSP, X-Frame-Options, HSTS, X-XSS-Protection, Referrer-Policy)
- main.py: fix CORS — allow_credentials=True is incompatible with allow_origins=["*"]; read origins from CORS_ORIGINS env var
- auth.py, logging_middleware.py: validate X-Forwarded-For/X-Real-IP to prevent IP spoofing

Performance:
- monitoring_worker.py: wire up cleanup_expired_connections() as hourly scheduled job (was defined but never called)

Code quality:
- logging_service.py: move `import json` from inside function to module level
- ssh_client.py, proxmox_client.py, api/proxmox.py, rbac/migration.py, task_queue_service.py: replace all bare `except:` with `except Exception:`
- .env.example, config.py: document ADMIN_PASSWORD and CORS_ORIGINS settings

https://claude.ai/code/session_019rK2wvaWg5zXFwmAPPEB7R

backend/app/workers/monitoring_worker.py

@@ -971,6 +971,20 @@ def start_monitoring_worker():
         name='Clean up expired notifications',
         replace_existing=True
     )
+
+    # Cleanup expired Proxmox connection cache - every hour
+    try:
+        from app.proxmox_client import cleanup_expired_connections
+        scheduler.add_job(
+            cleanup_expired_connections,
+            trigger=IntervalTrigger(hours=1),
+            id='proxmox_cache_cleanup',
+            name='Cleanup expired Proxmox connections',
+            replace_existing=True
+        )
+        logger.info("Proxmox cache cleanup task registered")
+    except ImportError as e:
+        logger.warning(f"Proxmox cache cleanup not available: {e}")
     
     # Run initial VM cache sync on startup
     try: