fix(securitate): hardening prod — headere, body-cap, non-root, backup

Findings security-review P1/P2 (2026-07-03):
- headere de securitate pe toate raspunsurile (nosniff, X-Frame-Options,
  Referrer-Policy, HSTS doar pe HTTPS) + teste
- body-cap global 10MB ca middleware ASGI pur (413 inainte de parserul
  multipart/JSON; verificarea per-endpoint ramane strat 2)
- imagine Docker non-root (uid 10001), port 8010 aliniat, loguri pe
  volumul /data
- fail-fast la boot cu rar_env=prod fara AUTOPASS_REQUIRE_API_KEY sau
  AUTOPASS_SESSION_SECRET
- compose: env-uri critice obligatorii (:?) ca api/worker sa nu diverga
  tacit; FORWARDED_ALLOW_IPS ca rate-limit-ul sa vada IP-ul real dupa
  Traefik
- signup fara PII in stdout: log_event in loc de print cu email (idem
  notify degradat)
- ratelimit: sterge cheile fara timestamp-uri valide (crestere monotona
  a memoriei pe IP-uri reale)
- backup criptat SQLite (backup online API, gpg AES256) + verificare
  restore + docs/backup.md

Suita completa verde: 1557 passed, 1 skipped (live).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -13,15 +13,35 @@ services:
       - autopass-data:/data
     environment:
       AUTOPASS_DB_PATH: /data/autopass.db
-      # Override din environment (Dokploy) pentru staging; default = prod.
-      AUTOPASS_RAR_ENV: ${AUTOPASS_RAR_ENV:-prod}
+      # Ancora globala, NU tinta trimiterilor: dupa PRD 5.20 mediul RAR e per
+      # submission/cont (worker-ul trimite dupa submissions.rar_env). Variabila
+      # asta serveste doar ca fallback API pentru conturi fara medii disponibile,
+      # backfill la migrare (db.py) si afisaj dashboard (routes.py). Obligatorie
+      # ca sa nu difere tacit intre api si worker (vezi worker mai jos).
+      AUTOPASS_RAR_ENV: ${AUTOPASS_RAR_ENV:?seteaza AUTOPASS_RAR_ENV (test|prod) in .env (vezi .env.example)}
       # Fus orar RO pentru bucketarea contoarelor azi/luna (SQLite 'localtime', E7).
       TZ: ${TZ:-Europe/Bucharest}
       AUTOPASS_CREDS_KEY: ${AUTOPASS_CREDS_KEY:?seteaza AUTOPASS_CREDS_KEY in .env (vezi .env.example)}
-      AUTOPASS_REQUIRE_API_KEY: ${AUTOPASS_REQUIRE_API_KEY:-false}
+      AUTOPASS_REQUIRE_API_KEY: ${AUTOPASS_REQUIRE_API_KEY:?seteaza AUTOPASS_REQUIRE_API_KEY (true in prod) in .env (vezi .env.example)}
       # Embeddings (sugestie mapare, Stratul 2): prima cerere /mapari lazy-load-eaza
       # modelul ~230MB. Doar API-ul il incarca (worker-ul nu). Default off.
       AUTOPASS_EMBEDDINGS_ENABLED: ${AUTOPASS_EMBEDDINGS_ENABLED:-false}
+      # uvicorn 0.30.0 are proxy_headers=True implicit; lipsea doar increderea in
+      # sursa headerelor, altfel request.client.host = IP-ul Traefik pentru toti
+      # vizitatorii (rate-limit login/signup devine o galeata GLOBALA). Uvicorn
+      # citeste FORWARDED_ALLOW_IPS direct din mediu (fara flag CLI necesar).
+      # ATENTIE, doua invariante trebuie sa ramana adevarate impreuna cu "*":
+      #  (1) serviciul api NU publica `ports:` pe host aici — accesibil DOAR prin Traefik;
+      #  (2) Traefik NU e configurat cu forwardedHeaders.insecure=true.
+      # Daca (2) e incalcat, un atacator poate falsifica X-Forwarded-For si ocoli
+      # rate-limit-ul (galeata noua per cerere = brute-force nelimitat).
+      FORWARDED_ALLOW_IPS: "*"
+      # Fara secret persistent, fiecare redeploy delogheaza toti userii (main.py
+      # genereaza unul efemer la runtime). HTTPS_ONLY=true e corect pentru prod,
+      # dar inseamna ca un smoke-test simplu pe HTTP NU poate face login (browserul
+      # dropeaza cookie-ul Secure) — pe HTTP local seteaza explicit false.
+      AUTOPASS_SESSION_SECRET: ${AUTOPASS_SESSION_SECRET:?seteaza AUTOPASS_SESSION_SECRET in .env (vezi .env.example)}
+      AUTOPASS_SESSION_HTTPS_ONLY: ${AUTOPASS_SESSION_HTTPS_ONLY:-true}
     restart: always
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8010/healthz').status==200 else 1)"]
@@ -36,11 +56,15 @@ services:
       - autopass-data:/data
     environment:
       AUTOPASS_DB_PATH: /data/autopass.db
-      AUTOPASS_RAR_ENV: ${AUTOPASS_RAR_ENV:-test}
+      # Vezi comentariul de la serviciul api: ancora globala, NU tinta trimiterilor
+      # (worker-ul trimite dupa submissions.rar_env, per cont). Aceeasi variabila
+      # obligatorie AICI, ca sa nu diverga tacit fata de api (era prod/test split-brain).
+      AUTOPASS_RAR_ENV: ${AUTOPASS_RAR_ENV:?seteaza AUTOPASS_RAR_ENV (test|prod) in .env (vezi .env.example)}
       AUTOPASS_CREDS_KEY: ${AUTOPASS_CREDS_KEY:?seteaza AUTOPASS_CREDS_KEY in .env (vezi .env.example)}
-      # Send activ by default (prod); pe staging seteaza AUTOPASS_WORKER_SEND_ENABLED=false
-      # in Dokploy ca worker-ul sa NU trimita declaratii reale la RAR (Legea 142/2023).
-      AUTOPASS_WORKER_SEND_ENABLED: ${AUTOPASS_WORKER_SEND_ENABLED:-true}
+      # Send catre RAR. Obligatoriu explicit — fara ea, un misconfig ar putea lasa
+      # worker-ul sa trimita declaratii reale neintentionat (Legea 142/2023).
+      # false = nu trimite (sigur pentru probe). true = end-to-end.
+      AUTOPASS_WORKER_SEND_ENABLED: ${AUTOPASS_WORKER_SEND_ENABLED:?seteaza AUTOPASS_WORKER_SEND_ENABLED (true|false) in .env (vezi .env.example)}
     restart: always
     depends_on:
       - api
@@ -68,5 +92,33 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
 
+  # Backup SQLite criptat (T2/P0-4, evidenta legala L.142/2023) — vezi docs/backup.md.
+  # Serviciu OPTIONAL, profil "backup": nu porneste la `docker compose up` normal.
+  # Activare: `docker compose --profile backup up -d backup` (sau COMPOSE_PROFILES=backup
+  # in mediul Dokploy). Alternativa fara profil compose: cron pe host care ruleaza
+  # `docker compose exec api bash tools/backup_db.sh` — mai simpla daca ai deja acces SSH
+  # la host, dar in Dokploy hostul poate fi gestionat/efemer, de aceea preferam varianta
+  # de mai jos (calatoreste cu image-ul, nu depinde de un cron configurat manual pe VM).
+  # backup:
+  #   build: .
+  #   profiles: ["backup"]
+  #   entrypoint: ["bash", "-c"]
+  #   command:
+  #     - |
+  #       while true; do
+  #         bash tools/backup_db.sh || echo "[backup] rulare esuata, reincerc la urmatorul ciclu"
+  #         sleep 86400
+  #       done
+  #   volumes:
+  #     - autopass-data:/data
+  #   environment:
+  #     AUTOPASS_DB_PATH: /data/autopass.db
+  #     AUTOPASS_BACKUP_DIR: ${AUTOPASS_BACKUP_DIR:-/data/backups}
+  #     AUTOPASS_BACKUP_KEEP: ${AUTOPASS_BACKUP_KEEP:-14}
+  #     AUTOPASS_BACKUP_PASSPHRASE_FILE: ${AUTOPASS_BACKUP_PASSPHRASE_FILE:-}
+  #     AUTOPASS_BACKUP_PASSPHRASE: ${AUTOPASS_BACKUP_PASSPHRASE:-}
+  #     AUTOPASS_BACKUP_RCLONE_REMOTE: ${AUTOPASS_BACKUP_RCLONE_REMOTE:-}
+  #   restart: always
+
 volumes:
   autopass-data: