fix: close the gaps a security review found in the default install

Reported against 2.2.1 by someone reading the source. Every finding held.

**Sign-in had no ceiling.** Failures were logged with the caller's address
and nothing more. Two counters now — one per address, one per account —
because the two attacks look different: one source working through many
accounts is caught by the first, many sources working on one account by the
second, and behind a proxy only the second still means anything.

The count is kept in the process that serves the request. PLANKA needs no
Redis and the stock deployment is one container; run several and each keeps
its own count, which multiplies the ceiling by their number. That trade is
written where the limits are configured.

**The second factor could be guessed at leisure.** Six digits, and a
pending token that stayed valid for its full ten minutes however many codes
were wrong. Wrong codes are now counted on the session row — in the
database, so the count survives a restart and holds across every process —
and when the budget is spent the session is destroyed. After that even the
right code is refused and the login starts over from the password.

**Avatars, background images and favicons** checked the token's signature
and nothing else, so a revoked session, a deactivated account or a changed
password all kept working there for as long as the signature lasted, which
is a year by default. The five checks the API makes now live in one helper
that both use, rather than the shortened copy that had drifted from it.

**A link attachment's favicon** was fetched from wherever the URL pointed.
Storing a link is harmless — it is a string the user typed — but fetching
its icon is a request the server makes to an address the user chose, and
whether an icon came back reported on what is reachable from inside the
network. Server-side fetches now refuse private, loopback and link-local
addresses, `169.254.169.254` among them. The attachment is still created:
linking to an internal wiki is a legitimate thing to do, and it was the
server's own request that had to stop.

**The signing key.** Our own compose file ships `notsecretkey`, and it is
printed in the documentation — so on any instance that copied it, anyone can
sign a token for any account. PLANKA now says so on every start, and keeps
saying it, along with a key that is missing or shorter than 32 characters.
The placeholder carries the warning inline, where it is copied from.

**The backup script** wrote password hashes, live sessions, TOTP secrets and
SMTP credentials to an unencrypted archive. `BACKUP_PASSPHRASE` now encrypts
it, and without one the script says what it just put on disk. It also says
what it is — an example for the stock compose stack, not a backup concept —
and names the window between the database dump and the file copy, which no
ordering closes.

server/api/helpers/utils/check-rate-limit.js

@@ -0,0 +1,73 @@
+/*!
+ * Copyright (c) 2026 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+// A fixed-window counter, held in the process that serves the request.
+//
+// PLANKA needs no Redis and the stock deployment is a single container, so the
+// count lives in memory rather than in shared storage. Run several processes
+// and each keeps its own, which multiplies the effective ceiling by their
+// number — enough to blunt a script, not a substitute for a limiter in front of
+// the app. That trade is stated where the limits are configured.
+//
+// The verdict comes back in the return value rather than as an exit: an exit
+// reaches an `await` as an Error wrapping its name, which is easy to catch
+// wrongly and easy to catch wrongly in silence.
+
+const buckets = new Map();
+
+// Beyond this many live keys, sweep what has expired before adding more. An
+// attacker can mint keys freely — one per made-up account name — so the map
+// must not be allowed to grow with them.
+const SWEEP_THRESHOLD = 10000;
+
+const sweep = (now) => {
+  buckets.forEach((bucket, key) => {
+    if (bucket.expiresAt <= now) {
+      buckets.delete(key);
+    }
+  });
+};
+
+module.exports = {
+  inputs: {
+    key: {
+      type: 'string',
+      required: true,
+    },
+    windowSeconds: {
+      type: 'number',
+      required: true,
+    },
+    max: {
+      type: 'number',
+      required: true,
+    },
+  },
+
+  sync: true,
+
+  fn(inputs) {
+    const now = Date.now();
+
+    if (buckets.size > SWEEP_THRESHOLD) {
+      sweep(now);
+    }
+
+    const bucket = buckets.get(inputs.key);
+
+    if (!bucket || bucket.expiresAt <= now) {
+      buckets.set(inputs.key, {
+        count: 1,
+        expiresAt: now + inputs.windowSeconds * 1000,
+      });
+
+      return { count: 1, isExceeded: inputs.max < 1 };
+    }
+
+    bucket.count += 1;
+
+    return { count: bucket.count, isExceeded: bucket.count > inputs.max };
+  },
+};