fix: P2 security and correctness issues

P2-10: Change ActivateEmail from GET to POST - token now passed in
request body instead of URL query parameter for better security

P2-11: Change ValidateResetToken from GET to POST - token now passed
in request body instead of URL query parameter to prevent log leakage

P2-12: Note - /uploads static exposure remains (requires architectural
decision about file serving)

P2-13: cursor.Encode() now checks and returns empty string on JSON
marshaling error instead of silently ignoring

P2-14: initDefaultData and ensurePermissions now properly check and
propagate errors from RolePermission creation, and createDefaultPermissions
aggregates errors instead of silently continuing

P2-15: NewJWT now returns (nil, error) on initialization failure
instead of a partially initialized object. All callers updated to handle
the error return.

Backend routes updated:
- POST /auth/activate-email (was GET /activate)
- POST /auth/password/validate (was GET /reset-password)

Frontend updated to match new API endpoints.

internal/concurrent/concurrent_test.go

@@ -100,7 +100,10 @@ func runTokenValidationConcurrencyTest(t *testing.T, testName string, config Con
 	result := NewConcurrencyTestResult()
 	result.ConcurrencyLevel = config.ConcurrentRequests
 
-	jwtManager := auth.NewJWT("concurrent-test-secret", 2*time.Hour, 7*24*time.Hour)
+	jwtManager, err := auth.NewJWT("concurrent-test-secret", 2*time.Hour, 7*24*time.Hour)
+	if err != nil {
+		t.Fatalf("failed to create JWT manager: %v", err)
+	}
 	tokens := make([]string, 100)
 	for i := 0; i < 100; i++ {
 		accessToken, _, err := jwtManager.GenerateTokenPair(int64(i+1), fmt.Sprintf("user%d", i), 0)
@@ -161,7 +164,10 @@ func runConcurrencyTest(t *testing.T, testName string, config ConcurrencyTestCon
 	result := NewConcurrencyTestResult()
 	result.ConcurrencyLevel = config.ConcurrentRequests
 
-	jwtManager := auth.NewJWT("concurrent-test-secret", 2*time.Hour, 7*24*time.Hour)
+	jwtManager, err := auth.NewJWT("concurrent-test-secret", 2*time.Hour, 7*24*time.Hour)
+	if err != nil {
+		t.Fatalf("failed to create JWT manager: %v", err)
+	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), config.TestDuration)
 	defer cancel()