fix: 보안 취약점 수정 및 XSS 방지 적용

## 백엔드 보안 수정
- 하드코딩된 비밀번호 및 JWT 시크릿 폴백 제거
- SQL Injection 방지를 위한 화이트리스트 검증 추가
- 인증 미적용 API 라우트에 requireAuth 미들웨어 적용
- CSRF 보호 미들웨어 구현 (csrf.js)
- 파일 업로드 보안 유틸리티 추가 (fileUploadSecurity.js)
- 비밀번호 정책 검증 유틸리티 추가 (passwordValidator.js)

## 프론트엔드 XSS 방지
- api-base.js에 전역 escapeHtml() 함수 추가
- 17개 주요 JS 파일에 escapeHtml 적용:
  - tbm.js, daily-patrol.js, daily-work-report.js
  - task-management.js, workplace-status.js
  - equipment-detail.js, equipment-management.js
  - issue-detail.js, issue-report.js
  - vacation-common.js, worker-management.js
  - safety-report-list.js, nonconformity-list.js
  - project-management.js, workplace-management.js

## 정리
- 백업 폴더 및 빈 파일 삭제
- SECURITY_GUIDE.md 문서 추가

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

web-ui/js/equipment-detail.js

@@ -99,27 +99,27 @@ function renderEquipmentInfo() {
     <div class="eq-info-grid">
       <div class="eq-info-item">
         <span class="eq-info-label">관리번호</span>
-        <span class="eq-info-value">${eq.equipment_code}</span>
+        <span class="eq-info-value">${escapeHtml(eq.equipment_code || '-')}</span>
       </div>
       <div class="eq-info-item">
         <span class="eq-info-label">설비명</span>
-        <span class="eq-info-value">${eq.equipment_name}</span>
+        <span class="eq-info-value">${escapeHtml(eq.equipment_name || '-')}</span>
       </div>
       <div class="eq-info-item">
         <span class="eq-info-label">모델명</span>
-        <span class="eq-info-value">${eq.model_name || '-'}</span>
+        <span class="eq-info-value">${escapeHtml(eq.model_name || '-')}</span>
       </div>
       <div class="eq-info-item">
         <span class="eq-info-label">규격</span>
-        <span class="eq-info-value">${eq.specifications || '-'}</span>
+        <span class="eq-info-value">${escapeHtml(eq.specifications || '-')}</span>
       </div>
       <div class="eq-info-item">
         <span class="eq-info-label">제조사</span>
-        <span class="eq-info-value">${eq.manufacturer || '-'}</span>
+        <span class="eq-info-value">${escapeHtml(eq.manufacturer || '-')}</span>
       </div>
       <div class="eq-info-item">
         <span class="eq-info-label">구입처</span>
-        <span class="eq-info-value">${eq.supplier || '-'}</span>
+        <span class="eq-info-value">${escapeHtml(eq.supplier || '-')}</span>
       </div>
       <div class="eq-info-item">
         <span class="eq-info-label">구입일</span>
@@ -131,11 +131,11 @@ function renderEquipmentInfo() {
       </div>
       <div class="eq-info-item">
         <span class="eq-info-label">시리얼번호</span>
-        <span class="eq-info-value">${eq.serial_number || '-'}</span>
+        <span class="eq-info-value">${escapeHtml(eq.serial_number || '-')}</span>
       </div>
       <div class="eq-info-item">
         <span class="eq-info-label">설비유형</span>
-        <span class="eq-info-value">${eq.equipment_type || '-'}</span>
+        <span class="eq-info-value">${escapeHtml(eq.equipment_type || '-')}</span>
       </div>
     </div>
   `;
@@ -219,12 +219,17 @@ function renderPhotos(photos) {
     return;
   }
 
-  grid.innerHTML = photos.map(photo => `
-    <div class="eq-photo-item" onclick="viewPhoto('${window.API_BASE_URL}${photo.photo_path}')">
-      <img src="${window.API_BASE_URL}${photo.photo_path}" alt="${photo.description || '설비 사진'}">
-      <button class="eq-photo-delete" onclick="event.stopPropagation(); deletePhoto(${photo.photo_id})">&times;</button>
-    </div>
-  `).join('');
+  grid.innerHTML = photos.map(photo => {
+    const safePhotoId = parseInt(photo.photo_id) || 0;
+    const safePhotoPath = encodeURI(photo.photo_path || '');
+    const safeDescription = escapeHtml(photo.description || '설비 사진');
+    return `
+      <div class="eq-photo-item" onclick="viewPhoto('${window.API_BASE_URL}${safePhotoPath}')">
+        <img src="${window.API_BASE_URL}${safePhotoPath}" alt="${safeDescription}">
+        <button class="eq-photo-delete" onclick="event.stopPropagation(); deletePhoto(${safePhotoId})">&times;</button>
+      </div>
+    `;
+  }).join('');
 }
 
 function openPhotoModal() {
@@ -323,7 +328,8 @@ function openMoveModal() {
   const factorySelect = document.getElementById('moveFactorySelect');
   factorySelect.innerHTML = '<option value="">공장을 선택하세요</option>';
   factories.forEach(f => {
-    factorySelect.innerHTML += `<option value="${f.category_id}">${f.category_name}</option>`;
+    const safeCategoryId = parseInt(f.category_id) || 0;
+    factorySelect.innerHTML += `<option value="${safeCategoryId}">${escapeHtml(f.category_name || '-')}</option>`;
   });
 
   document.getElementById('moveWorkplaceSelect').innerHTML = '<option value="">작업장을 선택하세요</option>';
@@ -354,7 +360,8 @@ async function loadMoveWorkplaces() {
       workplaces = response.data.data;
       workplaces.forEach(wp => {
         if (wp.map_image_url) {
-          workplaceSelect.innerHTML += `<option value="${wp.workplace_id}">${wp.workplace_name}</option>`;
+          const safeWorkplaceId = parseInt(wp.workplace_id) || 0;
+          workplaceSelect.innerHTML += `<option value="${safeWorkplaceId}">${escapeHtml(wp.workplace_name || '-')}</option>`;
         }
       });
     }
@@ -475,7 +482,8 @@ function openRepairModal() {
   const select = document.getElementById('repairItemSelect');
   select.innerHTML = '<option value="">선택하세요</option>';
   repairCategories.forEach(item => {
-    select.innerHTML += `<option value="${item.item_id}">${item.item_name}</option>`;
+    const safeItemId = parseInt(item.item_id) || 0;
+    select.innerHTML += `<option value="${safeItemId}">${escapeHtml(item.item_name || '-')}</option>`;
   });
 
   document.getElementById('repairDescription').value = '';
@@ -557,16 +565,20 @@ function renderRepairHistory(history) {
     return;
   }
 
-  container.innerHTML = history.map(h => `
-    <div class="eq-history-item">
-      <span class="eq-history-date">${formatDate(h.created_at)}</span>
-      <div class="eq-history-content">
-        <div class="eq-history-title">${h.item_name || '수리 요청'}</div>
-        <div class="eq-history-detail">${h.description || '-'}</div>
+  const validStatuses = ['pending', 'in_progress', 'completed', 'closed'];
+  container.innerHTML = history.map(h => {
+    const safeStatus = validStatuses.includes(h.status) ? h.status : 'pending';
+    return `
+      <div class="eq-history-item">
+        <span class="eq-history-date">${formatDate(h.created_at)}</span>
+        <div class="eq-history-content">
+          <div class="eq-history-title">${escapeHtml(h.item_name || '수리 요청')}</div>
+          <div class="eq-history-detail">${escapeHtml(h.description || '-')}</div>
+        </div>
+        <span class="eq-history-status ${safeStatus}">${getRepairStatusLabel(h.status)}</span>
       </div>
-      <span class="eq-history-status ${h.status}">${getRepairStatusLabel(h.status)}</span>
-    </div>
-  `).join('');
+    `;
+  }).join('');
 }
 
 function getRepairStatusLabel(status) {
@@ -664,16 +676,17 @@ function renderExternalLogs(logs) {
     const isReturned = !!log.actual_return_date;
     const statusClass = isReturned ? 'returned' : 'exported';
     const statusLabel = isReturned ? '반입완료' : '반출중';
+    const safeLogId = parseInt(log.log_id) || 0;
 
     return `
       <div class="eq-history-item">
         <span class="eq-history-date">${dateRange}</span>
         <div class="eq-history-content">
-          <div class="eq-history-title">${log.destination || '외부'}</div>
-          <div class="eq-history-detail">${log.reason || '-'}</div>
+          <div class="eq-history-title">${escapeHtml(log.destination || '외부')}</div>
+          <div class="eq-history-detail">${escapeHtml(log.reason || '-')}</div>
         </div>
         <span class="eq-history-status ${statusClass}">${statusLabel}</span>
-        ${!isReturned ? `<button class="eq-history-action" onclick="openReturnModal(${log.log_id})">반입처리</button>` : ''}
+        ${!isReturned ? `<button class="eq-history-action" onclick="openReturnModal(${safeLogId})">반입처리</button>` : ''}
       </div>
     `;
   }).join('');
@@ -748,15 +761,15 @@ function renderMoveLogs(logs) {
   container.innerHTML = logs.map(log => {
     const typeLabel = log.move_type === 'temporary' ? '임시이동' : '복귀';
     const location = log.move_type === 'temporary'
-      ? `${log.to_workplace_name || '-'}`
-      : `원위치 복귀`;
+      ? escapeHtml(log.to_workplace_name || '-')
+      : '원위치 복귀';
 
     return `
       <div class="eq-history-item">
         <span class="eq-history-date">${formatDateTime(log.moved_at)}</span>
         <div class="eq-history-content">
           <div class="eq-history-title">${typeLabel}: ${location}</div>
-          <div class="eq-history-detail">${log.reason || '-'} (${log.moved_by_name || '시스템'})</div>
+          <div class="eq-history-detail">${escapeHtml(log.reason || '-')} (${escapeHtml(log.moved_by_name || '시스템')})</div>
         </div>
       </div>
     `;