Follow up remaining CodeQL security alerts outside #226

Follow-up to #226. This issue tracks the remaining active CodeQL findings intentionally outside the targeted password-persistence, API/social rate-limit, and CSRF remediation.\n\nScope:\n- verify CodeQL closes the former user-controlled logout redirect after the CSRF companion change, and investigate only if it remains;\n- replace the permissive CORS configuration in `server/index.js` with an explicit origin allowlist;\n- add evidence-backed rate limiting for the remaining authorization and filesystem-serving routes (`server/auth/index.js`, `server/index.js`) and the `server/api/friends.test.js` fixture if it remains in CodeQL scope.\n\nAcceptance criteria:\n- every remediation has a focused regression test or runtime verification;\n- CodeQL is rerun and the finding is closed by code, not suppression, dismissal, or query changes;\n- CORS behavior is checked against the deployed frontend/auth callback configuration before production rollout (#176).\n\nDo not broaden this issue into database/schema or email-related work.

Comienza con los hallazgos de CodeQL y los puntos de entrada referenciados en server/index.js, server/auth/index.js y server/api/friends.test.js. Verifica si el hallazgo de redirección al cerrar sesión se cierra después del cambio complementario de CSRF; luego revisa el frontend desplegado y la configuración del callback de autenticación antes de comprobar el comportamiento de CORS. Se considera terminado cuando haya pruebas de regresión enfocadas o evidencia en tiempo de ejecución para cada remediación y se vuelva a ejecutar CodeQL con los hallazgos cerrados mediante código.

Escrito por el modelo de indexación a partir del texto del issue.