Refactor configuration and security features for improved development experience

- Updated the .env.example file to reflect a development environment setup with enhanced secret key requirements and local host settings.
- Modified the Docker Compose configuration to enhance security with read-only settings and no-new-privileges options.
- Updated requirements.txt to pin package versions for better dependency management.
- Enhanced the FastAPI application to include dynamic OpenAPI and documentation URLs based on the environment.
- Implemented session versioning in JWT tokens to improve security and user session management.
- Added new validation for user roles and password strength in schemas.
- Improved email sending logic to handle recipient lists more robustly and added logging for SMTP operations.
- Updated dashboard and profile templates to reflect new features and improve user experience.

.env.example

@@ -1,20 +1,26 @@
 APP_NAME=TK Wiki Newsletter Admin
-ENVIRONMENT=production
-SECRET_KEY=PLEASE_CHANGE_TO_A_LONG_RANDOM_SECRET
+# development = lokale Entwicklung ohne harte Produktions-Checks
+# production = erzwingt starke Secrets, ALLOWED_HOSTS, COOKIE_SECURE=true
+ENVIRONMENT=development
+SECRET_KEY=PLEASE_CHANGE_TO_A_LONG_RANDOM_SECRET_AT_LEAST_32_CHARS
 ALGORITHM=HS256
 ACCESS_TOKEN_EXPIRE_MINUTES=120
+JWT_ISSUER=tk-wiki-newsletter-admin
+JWT_AUDIENCE=tk-wiki-newsletter-admin
 HOST_PORT=8080
 DATABASE_URL=sqlite:///./data/newsletter.db
 # Beispiel PostgreSQL:
 # DATABASE_URL=postgresql+psycopg://newsletter:newsletter@postgres:5432/newsletter
 WIKI_API_URL=https://www.thomas-krenn.com/de/wikiDE/api.php
-ALLOWED_HOSTS=*
+ALLOWED_HOSTS=localhost,127.0.0.1
 COOKIE_SECURE=false
-# Auf true setzen, wenn hinter HTTPS/TLS-Terminierung (Reverse Proxy)
+# Auf true setzen, wenn hinter HTTPS/TLS-Terminierung (Reverse Proxy) – Pflicht in production
+HSTS_MAX_AGE=31536000
 ADMIN_BOOTSTRAP_EMAIL=admin@internal.local
 ADMIN_BOOTSTRAP_PASSWORD=ChangeMe123!
 # true = setzt Passwort/Rolle/Status des Bootstrap-Admins bei jedem Start
 # auf die obigen Werte zurueck (auch wenn der User schon existiert).
-# Nach erfolgreichem Login wieder auf false setzen, damit UI-Passwortaenderungen
-# nicht beim naechsten Neustart ueberschrieben werden.
+# In production nicht erlaubt. Nach Erst-Setup auf false lassen.
 ADMIN_BOOTSTRAP_RESET=false
+EDITOR_TIP_MAX_LENGTH=10000
+HIGHLIGHTS_MAX_LENGTH=5000