feat: version 3.0.0 -- Correcciones de auditoria de seguridad, accesibilidad y redundancia

Permisos (superadmin, viewer, busqueda, tareas recurrentes), bootstrap atomico,
revocacion de JWT por version de sesion (028), control optimista de edicion (029),
logo sin SVG + CSP, ingesta endurecida, correos escapados, borradores, paginacion
de proyectos, accesibilidad de dialogos/controles e i18n.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/src/modules/comments/repository.js

@@ -2,7 +2,7 @@ import { pool } from '../../config/db.js';
 
 export async function findByEntity(entityType, entityId) {
   const [rows] = await pool.query(
-    `SELECT c.id, c.entity_type, c.entity_id, c.user_id, u.name AS user_name, c.message, c.created_at, c.updated_at
+    `SELECT c.id, c.entity_type, c.entity_id, c.user_id, u.name AS user_name, c.message, c.edit_version, c.created_at, c.updated_at
      FROM comments c JOIN users u ON u.id = c.user_id
      WHERE c.entity_type = ? AND c.entity_id = ? ORDER BY c.created_at`,
     [entityType, entityId]
@@ -12,16 +12,16 @@ export async function findByEntity(entityType, entityId) {
 
 export async function findById(id) {
   const [rows] = await pool.query(
-    `SELECT c.id, c.entity_type, c.entity_id, c.user_id, u.name AS user_name, c.message, c.created_at, c.updated_at
+    `SELECT c.id, c.entity_type, c.entity_id, c.user_id, u.name AS user_name, c.message, c.edit_version, c.created_at, c.updated_at
      FROM comments c JOIN users u ON u.id = c.user_id WHERE c.id = ?`,
     [id]
   );
   return rows[0] || null;
 }
 
-export async function update(id, message) {
-  await pool.query('UPDATE comments SET message = ? WHERE id = ?', [message, id]);
-  return findById(id);
+export async function update(id, message, editVersion) {
+  const [result] = await pool.query('UPDATE comments SET message = ?, edit_version = edit_version + 1 WHERE id = ? AND edit_version = ?', [message, id, editVersion]);
+  return result.affectedRows ? findById(id) : null;
 }
 
 export async function remove(id) {