chore(release): public-release readiness and security fixes for 1.1.16

Security:
- Escape user-supplied values in LDAP filters and DNs (group_ldap.js, user_ldap.js)
- Replace Math.random() token/UUID/OTP generation with crypto.randomUUID / crypto.randomInt
- Refuse startup when oauth.jwtSecret is missing or placeholder

Fixes:
- Correct from-address template rendering in email.js

Packaging:
- Remove private flag and bump version to 1.1.16

Co-Authored-By: Claude <noreply@anthropic.com>

nodejs/models/oauth_client.js

@@ -2,7 +2,8 @@
 
 const Table = require('.');
 const bcrypt = require('bcrypt');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 const conf = require('@simpleworkjs/conf');
 
 const defaultLifetime = (conf.oauth && conf.oauth.token_lifetime) || {