security: round 1 — quick wins (rate limiting, headers, mass assignment, logging)

- Add throttle middleware to login (5/min), portal/token-auth (10/min),
  volunteer-register (5/min), and invitation routes (10/min)
- Set Sanctum token expiration to 7 days
- Remove billing_status from UpdateOrganisationRequest (super_admin only)
- Revoke all Sanctum tokens on password reset
- Strengthen password rules: min 8 chars, mixed case, numbers
- Create SecurityHeaders middleware (X-Content-Type-Options, X-Frame-Options,
  HSTS, Referrer-Policy, Permissions-Policy)
- Fix open redirect on all 3 login pages (validate ?to= starts with /)
- Set APP_DEBUG=false in .env.example
- Log failed login attempts with email, IP, user-agent
- Log authorization failures (403) with user, IP, path, method
- Harden mass assignment: remove user_id from Person, audit fields from
  ShiftAssignment, system fields from UserInvitation $fillable
- Replace real DB records with factory make() in mail preview routes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/admin/src/pages/login.vue

@@ -94,7 +94,8 @@ const login = async () => {
 
     // Redirect to `to` query if exist or redirect to index route
     await nextTick()
-    router.replace(route.query.to ? String(route.query.to) : '/')
+    const rawTo = route.query.to ? String(route.query.to) : ''
+    router.replace(rawTo.startsWith('/') ? rawTo : '/')
   }
   catch (err) {
     console.error(err)

apps/app/src/pages/login.vue

@@ -52,7 +52,8 @@ function handleLogin() {
     { email: form.value.email, password: form.value.password },
     {
       onSuccess: () => {
-        const redirectTo = route.query.to ? String(route.query.to) : '/dashboard'
+        const rawTo = route.query.to ? String(route.query.to) : ''
+        const redirectTo = rawTo.startsWith('/') ? rawTo : '/dashboard'
 
         router.replace(redirectTo)
       },

apps/portal/src/pages/login.vue

@@ -58,7 +58,8 @@ async function onSubmit(): Promise<void> {
 
   // Navigate after login — outside try/catch so navigation errors
   // (e.g. stale dynamic imports) don't mask a successful login.
-  let redirect = typeof route.query.to === 'string' ? route.query.to : ''
+  const rawRedirect = typeof route.query.to === 'string' ? route.query.to : ''
+  let redirect = rawRedirect.startsWith('/') ? rawRedirect : ''
 
   // Smart redirect based on number of events
   if (!redirect) {