fix(cms): implement v2 security and stability review findings

Resolves:
- CSRF false positive checked (global POST protection)
- Publish mutex to prevent git lock / double deploy
- Basic Auth rate limit checked before credential evaluation
- Memory leak in rate limiter (added GC interval)
- XSS in Toast messages
- XSS in data-path attribute
- CI healthcheck port mismatch (3000 -> 8080)
- Added security headers (X-Frame-Options, X-Content-Type-Options)

docker-compose.dev.yml

@@ -9,7 +9,7 @@ services:
       target: builder  # Use builder stage for development
     container_name: mozdit-app-dev
     ports:
-      - "8080:3000"
+      - "127.0.0.1:8080:3000"
     environment:
       - NODE_ENV=development
       - MONGODB_URI=mongodb://mongodb:27017/mozdit
@@ -36,7 +36,7 @@ services:
     image: mongo:7.0
     container_name: mozdit-mongodb-dev
     ports:
-      - "27018:27017"
+      - "127.0.0.1:27018:27017"
     environment:
       - MONGO_INITDB_ROOT_USERNAME=admin
       - MONGO_INITDB_ROOT_PASSWORD=password123
@@ -53,7 +53,7 @@ services:
     image: mongo-express:1.0.2
     container_name: mozdit-mongo-express-dev
     ports:
-      - "8081:8081"
+      - "127.0.0.1:8081:8081"
     environment:
       - ME_CONFIG_MONGODB_ADMINUSERNAME=admin
       - ME_CONFIG_MONGODB_ADMINPASSWORD=password123
@@ -70,7 +70,7 @@ services:
     image: grafana/loki:2.9.0
     container_name: mozdit-loki-dev
     ports:
-      - "3100:3100"
+      - "127.0.0.1:3100:3100"
     command: -config.file=/etc/loki/local-config.yaml
     volumes:
       - loki_data:/loki
@@ -83,7 +83,7 @@ services:
     image: grafana/grafana:10.2.0
     container_name: mozdit-grafana-dev
     ports:
-      - "3001:3000"
+      - "127.0.0.1:3001:3000"
     environment:
       - GF_SECURITY_ADMIN_PASSWORD=admin123
     volumes: