Comprehensive optimization analysis and security improvements for NOP

.env.example

@@ -1,47 +1,96 @@
 # Network Observatory Platform Configuration
+# ============================================
+# IMPORTANT: Copy this file to .env and change all values marked as required
 
-# Security
-SECRET_KEY=your-secret-key-change-this-to-random-string
+# ======================
+# Security (REQUIRED)
+# ======================
+# Generate with: openssl rand -hex 32
+SECRET_KEY=your-secret-key-change-this-to-random-string-at-least-32-chars
+
+# Generate with: openssl rand -hex 32 (must be exactly 64 hex chars = 32 bytes)
+MASTER_ENCRYPTION_KEY=
+
+# Admin account (CHANGE IMMEDIATELY after first login)
+ADMIN_USERNAME=admin
 ADMIN_PASSWORD=changeme
 
+# ======================
 # Database
+# ======================
 POSTGRES_DB=nop
 POSTGRES_USER=nop
 POSTGRES_PASSWORD=nop_password
 DATABASE_URL=postgresql://nop:nop_password@postgres:5432/nop
 
+# ======================
 # Redis
+# ======================
 REDIS_URL=redis://redis:6379/0
 
+# ======================
 # Network Configuration
+# ======================
 NETWORK_INTERFACE=eth0
 MONITOR_SUBNETS=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
+EXCLUDED_IPS=
 
+# ======================
 # Discovery Settings
+# ======================
+# Options: passive_only, active_passive, aggressive
 DISCOVERY_MODE=passive_only
 SCAN_INTERVAL=300
 ENABLE_ACTIVE_DISCOVERY=false
 
+# ======================
 # Traffic Analysis
+# ======================
 ENABLE_DPI=true
 DATA_RETENTION_DAYS=30
+# Options: low, medium, high
 ALERT_SENSITIVITY=medium
 
+# ======================
 # Security Features
+# ======================
 ENABLE_OFFENSIVE_TOOLS=false
 AUTO_CVE_SCAN=false
 CREDENTIAL_ENCRYPTION=true
 
-# Logging
+# ======================
+# JWT Settings
+# ======================
+ACCESS_TOKEN_EXPIRE_MINUTES=60
+REFRESH_TOKEN_EXPIRE_DAYS=7
+
+# ======================
+# Rate Limiting
+# ======================
+RATE_LIMIT_REQUESTS_PER_MINUTE=100
+
+# ======================
+# Logging & Audit
+# ======================
 LOG_LEVEL=INFO
 AUDIT_LOGGING=true
 
+# ======================
 # External Services
+# ======================
 NTOPNG_PORT=3001
 FRONTEND_PORT=12000
 BACKEND_PORT=8000
 
+# ======================
+# CORS Configuration
+# ======================
+# Comma-separated list of allowed origins
+CORS_ORIGINS=http://localhost:12000,http://localhost:3000
+
+# ======================
 # SSL/TLS (Optional)
+# ======================
 SSL_ENABLED=false
 SSL_CERT_PATH=/app/certs/cert.pem
 SSL_KEY_PATH=/app/certs/key.pem