fix(security): 전체 서비스 보안 점검 — XSS·인가·토큰·헤더·에러마스킹 일괄 수정

Phase 1 CRITICAL XSS:
- marked.parse() → DOMPurify.sanitize() (system3 ai-assistant, issues-management)
- toast innerHTML에 escapeHtml 적용 (system1 api-base, system3 common-header)
- onclick 핸들러 → data 속성 + addEventListener (system2 issue-detail)

Phase 2 HIGH 인가:
- getUserBalance 본인확인 추가 (tksupport vacationController)

Phase 3 HIGH 토큰+CSP:
- localStorage 토큰 저장 제거 — 쿠키 전용 (7개 서비스)
- unsafe-eval CSP 제거 (system1 security.js)

Phase 4 MEDIUM:
- nginx 보안 헤더 추가 (8개 서비스)
- 500 에러 메시지 마스킹 (5개 API)
- path traversal 방지 (system3 file_service.py)
- cookie fallback 데드코드 제거 (4개 auth.js)
- /login/form rate limiting 추가 (sso-auth)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

system1-factory/web/pages/admin/attendance-report.html

@@ -191,7 +191,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script type="module">
     import '/js/api-config.js?v=3';

system1-factory/web/pages/admin/departments.html

@@ -325,7 +325,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="/js/department-management.js"></script>
   <script>initAuth();</script>
 </body>

system1-factory/web/pages/admin/equipment-detail.html

@@ -315,7 +315,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script type="module">
     import '/js/api-config.js?v=3';

system1-factory/web/pages/admin/equipments.html

@@ -191,7 +191,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script type="module">
     import '/js/api-config.js?v=3';

system1-factory/web/pages/admin/issue-categories.html

@@ -330,7 +330,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script type="module" src="/js/issue-category-manage.js"></script>
   <script>initAuth();</script>
 </body>

system1-factory/web/pages/admin/notifications.html

@@ -388,7 +388,7 @@
     </div>
 
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <script>
         let currentPage = 1;
         let totalPages = 1;

system1-factory/web/pages/admin/projects.html

@@ -385,7 +385,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script>
     let allProjects = [];
     let filteredProjects = [];

system1-factory/web/pages/admin/repair-management.html

@@ -488,7 +488,7 @@
     </div>
 
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <script>
         let currentReportId = null;
         let allRepairs = [];

system1-factory/web/pages/admin/tasks.html

@@ -286,7 +286,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script>
     let workTypes = [];
     let tasks = [];

system1-factory/web/pages/admin/workplaces.html

@@ -432,7 +432,7 @@
 
   <!-- 작업장 관리 모듈 (리팩토링된 구조) -->
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="/js/workplace-management/state.js?v=1"></script>
   <script src="/js/workplace-management/utils.js?v=1"></script>
   <script src="/js/workplace-management/api.js?v=1"></script>