fix: resolve gosec G117 secret pattern lint issues

- Add json:"-" tags to SessionSecret and PrivateKey fields
- Replace login request struct with map[string]string to avoid
  exported field matching secret pattern in JSON key

internal/config/config.go

@@ -51,7 +51,7 @@ type Config struct {
 	MaintenanceMode bool
 	MetricsUsername string
 	MetricsPassword string
-	SessionSecret   string
+	SessionSecret   string `json:"-"`
 	CORSOrigins     string
 	params          *Params
 	log             *slog.Logger