fix(securitate): hardening prod — headere, body-cap, non-root, backup

Findings security-review P1/P2 (2026-07-03):
- headere de securitate pe toate raspunsurile (nosniff, X-Frame-Options,
  Referrer-Policy, HSTS doar pe HTTPS) + teste
- body-cap global 10MB ca middleware ASGI pur (413 inainte de parserul
  multipart/JSON; verificarea per-endpoint ramane strat 2)
- imagine Docker non-root (uid 10001), port 8010 aliniat, loguri pe
  volumul /data
- fail-fast la boot cu rar_env=prod fara AUTOPASS_REQUIRE_API_KEY sau
  AUTOPASS_SESSION_SECRET
- compose: env-uri critice obligatorii (:?) ca api/worker sa nu diverga
  tacit; FORWARDED_ALLOW_IPS ca rate-limit-ul sa vada IP-ul real dupa
  Traefik
- signup fara PII in stdout: log_event in loc de print cu email (idem
  notify degradat)
- ratelimit: sterge cheile fara timestamp-uri valide (crestere monotona
  a memoriei pe IP-uri reale)
- backup criptat SQLite (backup online API, gpg AES256) + verificare
  restore + docs/backup.md

Suita completa verde: 1557 passed, 1 skipped (live).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/web/ratelimit.py

@@ -7,10 +7,9 @@ Configurabil prin AUTOPASS_signup_rate_max / AUTOPASS_signup_rate_window_s (conf
 from __future__ import annotations
 
 import time
-from collections import defaultdict
 
 # ip/key -> lista de timestamps (time.monotonic) ale cererilor din fereastra activa
-_hits: dict[str, list[float]] = defaultdict(list)
+_hits: dict[str, list[float]] = {}
 
 
 def check_rate_limit(key: str, max_hits: int, window_s: int) -> bool:
@@ -19,13 +18,21 @@ def check_rate_limit(key: str, max_hits: int, window_s: int) -> bool:
     Curata timestamp-urile expirate la fiecare apel (O(n) per cheie, acceptabil
     pentru trafic de signup). Thread-safety: GIL Python protejeaza list ops simple;
     suficient pentru un singur proces uvicorn.
+
+    Cheile fara timestamp-uri valide sunt sterse din `_hits` (nu doar golite), altfel
+    dictionarul creste monoton pe viata procesului odata ce cheia devine IP-uri reale
+    de internet (F5). Foloseste `.get` in loc de acces direct pe dict pentru a nu
+    reintroduce o cheie doar prin citire.
     """
     now = time.monotonic()
     cutoff = now - window_s
-    timestamps = _hits[key]
-    # Sterge intrari expirate
-    _hits[key] = [t for t in timestamps if t > cutoff]
-    if len(_hits[key]) >= max_hits:
+    filtered = [t for t in _hits.get(key, []) if t > cutoff]
+    if len(filtered) >= max_hits:
+        if filtered:
+            _hits[key] = filtered
+        else:
+            _hits.pop(key, None)
         return False
-    _hits[key].append(now)
+    filtered.append(now)
+    _hits[key] = filtered
     return True