feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docker-compose.yml

@@ -14,6 +14,8 @@ services:
       - ConnectionStrings__JobTracker=${JOBTRACKER_CONNECTION_STRING}
       # If you enable HTTPS at a reverse proxy (recommended), handle redirects there.
       - HttpsRedirection__Enabled=false
+      # Backend is internal-only here; nginx is the sole trusted ingress.
+      - Proxy__TrustForwardedHeaders=true
       # Authentication (recommended for any non-local deployment)
       - Auth__Require=true
       - Auth__JwtKey=${AUTH_JWT_KEY}
@@ -22,6 +24,9 @@ services:
       - Auth__AllowRegistration=${AUTH_ALLOW_REGISTRATION:-false}
       - Turnstile__SiteKey=${TURNSTILE_SITE_KEY}
       - Turnstile__SecretKey=${TURNSTILE_SECRET_KEY}
+      - Stripe__SecretKey=${STRIPE_SECRET_KEY}
+      - Stripe__PricePremium=${STRIPE_PRICE_PREMIUM}
+      - Stripe__WebhookSecret=${STRIPE_WEBHOOK_SECRET}
       # Optional: allow Google / Microsoft ID-token bearer auth (sign-in, not mail access)
       - Auth__GoogleClientId=${AUTH_GOOGLE_CLIENT_ID}
       - Auth__MicrosoftClientId=${AUTH_MICROSOFT_CLIENT_ID}
@@ -65,6 +70,10 @@ services:
       # ai-service.
       - ai_internal
     restart: unless-stopped
+    logging:
+      options:
+        max-size: "10m"
+        max-file: "3"
     # Liveness only. /health does not touch the database on purpose: a health check that queried
     # MariaDB would restart a healthy backend whenever the database blipped.
     # start_period covers first-boot schema reconciliation, which can take a while on a new database.
@@ -85,7 +94,7 @@ services:
         - NEXT_PUBLIC_GOOGLE_CLIENT_ID=${AUTH_GOOGLE_CLIENT_ID}
         - NEXT_PUBLIC_MICROSOFT_CLIENT_ID=${AUTH_MICROSOFT_CLIENT_ID}
         # Optional override; default in production is `/api`
-        - NEXT_PUBLIC_API_BASE_URL=${REACT_APP_API_BASE_URL}
+        - NEXT_PUBLIC_API_BASE_URL=${NEXT_PUBLIC_API_BASE_URL}
     ports:
       - "3000:80"
     depends_on:
@@ -95,6 +104,10 @@ services:
       - default
       - shared_services
     restart: unless-stopped
+    logging:
+      options:
+        max-size: "10m"
+        max-file: "3"
     # Cheap liveness: nginx answering on its own port. wget ships with the alpine base.
     healthcheck:
       test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:80/"]
@@ -141,6 +154,10 @@ services:
     networks:
       - ai_internal
     restart: unless-stopped
+    logging:
+      options:
+        max-size: "10m"
+        max-file: "3"
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8001/health', timeout=5).read()"]
       interval: 30s
@@ -170,6 +187,10 @@ services:
       - shared_services
       - ai_internal
     restart: unless-stopped
+    logging:
+      options:
+        max-size: "10m"
+        max-file: "3"
     gpus: all
     healthcheck:
       test: ["CMD", "ollama", "list"]