Guidance required on security for BookStack #2866

Hi

I am a VERY happy user of BookStack and am really impressed with its level of features, but I wonder if anyone could weigh in with their experiences of tightening security of BookStack.

I have been tasked with improving the security of both the app and server - not my field of expertise as I'm a Technical Author / Engineer, but I'm learning as I go... I don't really need suggestions on what to do, rather I need comments relating to the impact of enabling/implementing certain features within BookStack. I will summarise below (apologies for the length, but I'm trying to be thorough):

1. Higher security image uploads - I have enabled this (as I understand what it does). However, I assume this only applies to new image uploads? Is it possible to apply this to existing image uploads? I have also implemented the change to the Apache 2 virtual hosts config: <Location "/uploads"> Options -Indexes </Location>
2. Public access - I have turned this off as it seems that this is too risky given the sensitive nature of some of our information. Public access isn't a problem per se, but once other people start having editing rights this could cause a problem, hence disabling it. I have also added ALLOW_ROBOTS=false to the .env file; I suppose this isn't necessary with public access off, but it seemed sensible to do. Is this the case?
3. APP_URL - this is set to the specific https address of our instance in the .env file - I assume nothing further is required for this?
4. Host Iframe Control - This might seem like overkill, but I also enabled ```ALLOWED_IFRAME_HOSTS="https://xxxxxxxx.com"` to the .env file as well, more as a precaution - will this cause any issues?
5. Secure Cookies - again, might be overkill but I enabled SESSION_SECURE_COOKIE=true in the .env file even though the instance is served by https - again, will this cause issues?
6. Failed Access Logging - I installed Fail2Ban on the server, so I added the LOG_FAILED_LOGIN_MESSAGE option to the .env file
7. Image Authentication - I'm really confused on this one....I understand I need to move all my 'public' images to storage/uploads/images then delete anything in public/uploads/images, but will my existing pages still be able to access the images once I have moved them? Also, what does you may have to clean-up and re-upload any ‘App Icon’ images, in settings mean? Is this the 'Cleanup' option in 'Settings' 'Maintenance'?
8. Authentication Methods - is adopting an authentication method such as LDAP or AzureAD more secure that the normal user/password login method, or is it just more convenient? I have no expertise in this area but I think our IT guys use Azure and LDAP on other apps, so this shouldn't present a problem if I need to implement it.

I think that covers everything - apologies for the length of the post and hope you can shed light on this for me!

Best wishes

Mark