hotfix: Security, performance, and code cleanup

- Remove hardcoded database password fallback
- Add encryption salt validation (min 32 chars)
- Separate EMAIL_ENCRYPTION_KEY from JWT_SECRET
- Fix command injection in status.service.js (use execFileSync)
- Remove unnecessary SQL injection regex middleware
- Create shared utilities (queryBuilder, pagination, emailAccountHelper)
- Fix N+1 query problems in contact and todo services
- Merge duplicate JMAP config functions
- Add database indexes migration
- Standardize error responses with error codes

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/db/migrations/0002_add_indexes.sql

@@ -0,0 +1,21 @@
+-- Add indexes for frequently used foreign keys
+CREATE INDEX IF NOT EXISTS idx_contacts_email_account_id ON contacts(email_account_id);
+CREATE INDEX IF NOT EXISTS idx_contacts_company_id ON contacts(company_id);
+CREATE INDEX IF NOT EXISTS idx_todos_project_id ON todos(project_id);
+CREATE INDEX IF NOT EXISTS idx_todos_company_id ON todos(company_id);
+CREATE INDEX IF NOT EXISTS idx_notes_company_id ON notes(company_id);
+CREATE INDEX IF NOT EXISTS idx_notes_project_id ON notes(project_id);
+CREATE INDEX IF NOT EXISTS idx_notes_todo_id ON notes(todo_id);
+
+-- Add indexes for search fields
+CREATE INDEX IF NOT EXISTS idx_contacts_email ON contacts(email);
+CREATE INDEX IF NOT EXISTS idx_companies_name ON companies(name);
+CREATE INDEX IF NOT EXISTS idx_projects_name ON projects(name);
+
+-- Add indexes for status/filter fields
+CREATE INDEX IF NOT EXISTS idx_todos_status ON todos(status);
+CREATE INDEX IF NOT EXISTS idx_projects_status ON projects(status);
+
+-- Add composite indexes for frequent queries
+CREATE INDEX IF NOT EXISTS idx_todos_user_status ON todo_users(user_id, todo_id);
+CREATE INDEX IF NOT EXISTS idx_time_entries_user_start ON time_entries(user_id, start_time);