fix(securitate): hardening prod — headere, body-cap, non-root, backup

Findings security-review P1/P2 (2026-07-03):
- headere de securitate pe toate raspunsurile (nosniff, X-Frame-Options,
  Referrer-Policy, HSTS doar pe HTTPS) + teste
- body-cap global 10MB ca middleware ASGI pur (413 inainte de parserul
  multipart/JSON; verificarea per-endpoint ramane strat 2)
- imagine Docker non-root (uid 10001), port 8010 aliniat, loguri pe
  volumul /data
- fail-fast la boot cu rar_env=prod fara AUTOPASS_REQUIRE_API_KEY sau
  AUTOPASS_SESSION_SECRET
- compose: env-uri critice obligatorii (:?) ca api/worker sa nu diverga
  tacit; FORWARDED_ALLOW_IPS ca rate-limit-ul sa vada IP-ul real dupa
  Traefik
- signup fara PII in stdout: log_event in loc de print cu email (idem
  notify degradat)
- ratelimit: sterge cheile fara timestamp-uri valide (crestere monotona
  a memoriei pe IP-uri reale)
- backup criptat SQLite (backup online API, gpg AES256) + verificare
  restore + docs/backup.md

Suita completa verde: 1557 passed, 1 skipped (live).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_security_headers.py

@@ -0,0 +1,64 @@
+"""Teste P1-4 (hardening 2026-07-03): security headers pe TOATE raspunsurile."""
+
+from __future__ import annotations
+
+import os
+import tempfile
+
+import pytest
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture()
+def client(monkeypatch):
+    tmp = tempfile.mkdtemp()
+    monkeypatch.setenv("AUTOPASS_DB_PATH", os.path.join(tmp, "sh.db"))
+    monkeypatch.setenv("AUTOPASS_LOG_DIR", os.path.join(tmp, "logs"))
+    from app.config import get_settings
+    get_settings.cache_clear()
+    from app.main import app
+    with TestClient(app) as c:
+        yield c
+    get_settings.cache_clear()
+
+
+def _assert_common_headers(headers) -> None:
+    assert headers.get("X-Content-Type-Options") == "nosniff"
+    assert headers.get("X-Frame-Options") == "DENY"
+    assert headers.get("Referrer-Policy") == "strict-origin-when-cross-origin"
+
+
+def test_headere_pe_raspuns_200(client):
+    r = client.get("/healthz")
+    assert r.status_code == 200
+    _assert_common_headers(r.headers)
+
+
+def test_headere_pe_raspuns_404(client):
+    r = client.get("/o/ruta/care/nu/exista")
+    assert r.status_code == 404
+    _assert_common_headers(r.headers)
+
+
+def test_hsts_absent_pe_http(client):
+    r = client.get("/healthz")
+    assert "Strict-Transport-Security" not in r.headers
+
+
+def test_hsts_prezent_pe_https():
+    tmp = tempfile.mkdtemp()
+    import os as _os
+
+    _os.environ["AUTOPASS_DB_PATH"] = _os.path.join(tmp, "sh_https.db")
+    from app.config import get_settings
+    get_settings.cache_clear()
+    from app.main import app
+
+    with TestClient(app, base_url="https://testserver") as c:
+        r = c.get("/healthz")
+        assert r.status_code == 200
+        assert r.headers.get("Strict-Transport-Security") == (
+            "max-age=31536000; includeSubDomains"
+        )
+    get_settings.cache_clear()
+    _os.environ.pop("AUTOPASS_DB_PATH", None)