Security improvements:
- Login brute force protection with django-axes (5 attempts, 15 min lockout)
- SSRF protection for webhook URLs (blocks localhost/private networks)
- Path traversal prevention for environment directories
- Backup/restore operations now require superuser
- Webhook rate limiting (30 req/min per IP)
- Setup wizard CSRF protection and explicit POST required
- Filename sanitization for requirement exports
- Pip flag blocking for package specs

New features:
- Configurable Django admin URL path (Settings > General)

Fixes:
- Dynamic NPM path detection for cross-platform compatibility

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>