Kimai Docker Vulnerability Exposes Default APP_SECRET, Enabling Account Takeover

Kimai's official Docker image prior to version 2.58.0 shipped an insecure default APP_SECRET (`APP_SECRET=change_this_to_something_unique`) used as the Symfony kernel.secret, and the entrypoint did not replace or refuse this default. This allows an attacker who knows a username and account ID and targets accounts without 2FA to forge remember-me cookies, login links, password-reset URLs and CSRF tokens and potentially take over accounts (including super_admin). The issue is fixed in 2.58.0 by generating and storing a random APP_SECRET at startup; administrators should upgrade immediately, set/rotate secrets, invalidate sessions, enable 2FA and restrict public access.