fix(security): critical — repair PIN reset + enforce real prod secrets

C1: reset_user_pin wrote to a non-existent column (pin_failed_attempts);
    the real column is failed_pin_attempts, so every PIN reset 500'd. Fixed
    the column name; new e2e (pin-reset.spec.ts) proves a reset returns a
    usable PIN and the target can recover with it.

C2: config.rs::validate_secrets now rejects placeholder-ish secrets
    (change_me/dev_secret/placeholder), enforces len>=32 in prod, and
    requires a real ADMIN_PASSWORD_HASH. docker-compose.yml sets
    APP_ENV=production so the guard actually runs. Corrected the false
    "fixed" claim in SECURITY-BACKLOG.md. .env.example documents the rule.

Riders in these files (documented here since git can't split hunks):
- host.rs also carries the event-scoped ban_user fix and the
  close_event/open_event no-op broadcast guard (medium).
- docker-compose.yml also adds ORIGIN (H6), app/frontend healthchecks with
  Caddy waiting on health, and per-service memory limits (medium).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -4,6 +4,10 @@ DOMAIN=my-event.example.com
 
 # ── App server ────────────────────────────────────────────────────────────────
 APP_PORT=3000
+# Set to `production` in real deployments. This activates the secret guard that
+# refuses to boot with placeholder JWT_SECRET / ADMIN_PASSWORD_HASH values.
+# (docker-compose.yml already sets APP_ENV=production for the app service.)
+APP_ENV=production
 
 # ── Database ──────────────────────────────────────────────────────────────────
 # Set a strong password and keep it in sync between DATABASE_URL and