fix(securitate): hardening prod — headere, body-cap, non-root, backup

Findings security-review P1/P2 (2026-07-03):
- headere de securitate pe toate raspunsurile (nosniff, X-Frame-Options,
  Referrer-Policy, HSTS doar pe HTTPS) + teste
- body-cap global 10MB ca middleware ASGI pur (413 inainte de parserul
  multipart/JSON; verificarea per-endpoint ramane strat 2)
- imagine Docker non-root (uid 10001), port 8010 aliniat, loguri pe
  volumul /data
- fail-fast la boot cu rar_env=prod fara AUTOPASS_REQUIRE_API_KEY sau
  AUTOPASS_SESSION_SECRET
- compose: env-uri critice obligatorii (:?) ca api/worker sa nu diverga
  tacit; FORWARDED_ALLOW_IPS ca rate-limit-ul sa vada IP-ul real dupa
  Traefik
- signup fara PII in stdout: log_event in loc de print cu email (idem
  notify degradat)
- ratelimit: sterge cheile fara timestamp-uri valide (crestere monotona
  a memoriei pe IP-uri reale)
- backup criptat SQLite (backup online API, gpg AES256) + verificare
  restore + docs/backup.md

Suita completa verde: 1557 passed, 1 skipped (live).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/email.py

@@ -11,6 +11,7 @@ import textwrap
 from email.message import EmailMessage
 
 from .config import get_settings
+from .observ import log_event
 
 
 def notify_signup(admin_emails: list[str], account_id: int, email: str) -> None:
@@ -23,10 +24,11 @@ def notify_signup(admin_emails: list[str], account_id: int, email: str) -> None:
     settings = get_settings()
 
     if not settings.smtp_host or not admin_emails:
-        print(
-            f"SIGNUP-NOTIFY degradat (fara SMTP) cont={account_id} "
-            f"email={email} admins={len(admin_emails)}",
-            flush=True,
+        log_event(
+            "signup_notify_degradat",
+            account_id=account_id,
+            mesaj="fara SMTP configurat",
+            context={"admins": len(admin_emails)},
         )
         return