## 백엔드 보안 수정
- 하드코딩된 비밀번호 및 JWT 시크릿 폴백 제거
- SQL Injection 방지를 위한 화이트리스트 검증 추가
- 인증 미적용 API 라우트에 requireAuth 미들웨어 적용
- CSRF 보호 미들웨어 구현 (csrf.js)
- 파일 업로드 보안 유틸리티 추가 (fileUploadSecurity.js)
- 비밀번호 정책 검증 유틸리티 추가 (passwordValidator.js)
## 프론트엔드 XSS 방지
- api-base.js에 전역 escapeHtml() 함수 추가
- 17개 주요 JS 파일에 escapeHtml 적용:
- tbm.js, daily-patrol.js, daily-work-report.js
- task-management.js, workplace-status.js
- equipment-detail.js, equipment-management.js
- issue-detail.js, issue-report.js
- vacation-common.js, worker-management.js
- safety-report-list.js, nonconformity-list.js
- project-management.js, workplace-management.js
## 정리
- 백업 폴더 및 빈 파일 삭제
- SECURITY_GUIDE.md 문서 추가
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replaced `SELECT *` statements across multiple data models with explicit column lists to improve query performance, reduce data transfer, and increase code clarity. This is part of the Phase 2 refactoring plan.
- Refactored queries in the following models:
- projectModel
- toolsModel
- attendanceModel
- dailyIssueReportModel
- issueTypeModel
- workReportModel
- userModel
- dailyWorkReportModel
fix(api): Add missing volume mounts to docker-compose
Modified docker-compose.yml to mount the `config`, `middlewares`, `utils`, and `services` directories into the API container. This fixes a `MODULE_NOT_FOUND` error that caused the container to crash on startup.
feat(db): Add migration for missing project columns
Created a new database migration to add `is_active`, `project_status`, and `completed_date` columns to the `projects` table, resolving an inconsistency between the model code and the schema.
docs: Add deployment notes
Added a new markdown file to document the testing (macOS, Docker Desktop) and production (Synology NAS, Container Manager) environments.
