fix: round 10 critical fixes - WebSocket race, rate limiting, XSS protection, Caddyfile, and input validation

backend/gateway/internal/handler/reminder_handler.go

@@ -2,6 +2,7 @@ package handler
 
 import (
 	"encoding/json"
+	"html"
 	"log"
 	"net/http"
 	"strconv"
@@ -113,8 +114,8 @@ func (h *ReminderHandler) Create(c *gin.Context) {
 	reminder := &store.Reminder{
 		ID:          generateID(),
 		UserID:      userID,
-		Title:       req.Title,
-		Description: req.Description,
+		Title:       html.EscapeString(req.Title),
+		Description: html.EscapeString(req.Description),
 		RemindAt:    remindAt,
 		Status:      "pending",
 		RepeatType:  repeatType,