chore(release): public-release readiness and security fixes for 1.1.16

Security:
- Escape user-supplied values in LDAP filters and DNs (group_ldap.js, user_ldap.js)
- Replace Math.random() token/UUID/OTP generation with crypto.randomUUID / crypto.randomInt
- Refuse startup when oauth.jwtSecret is missing or placeholder

Fixes:
- Correct from-address template rendering in email.js

Packaging:
- Remove private flag and bump version to 1.1.16

Co-Authored-By: Claude <noreply@anthropic.com>

nodejs/package.json

@@ -1,7 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.1.15",
-  "private": true,
+  "version": "1.1.16",
   "author": [
     {
       "name": "William Mantly",