fix(securitate): hardening prod — headere, body-cap, non-root, backup

Findings security-review P1/P2 (2026-07-03):
- headere de securitate pe toate raspunsurile (nosniff, X-Frame-Options,
  Referrer-Policy, HSTS doar pe HTTPS) + teste
- body-cap global 10MB ca middleware ASGI pur (413 inainte de parserul
  multipart/JSON; verificarea per-endpoint ramane strat 2)
- imagine Docker non-root (uid 10001), port 8010 aliniat, loguri pe
  volumul /data
- fail-fast la boot cu rar_env=prod fara AUTOPASS_REQUIRE_API_KEY sau
  AUTOPASS_SESSION_SECRET
- compose: env-uri critice obligatorii (:?) ca api/worker sa nu diverga
  tacit; FORWARDED_ALLOW_IPS ca rate-limit-ul sa vada IP-ul real dupa
  Traefik
- signup fara PII in stdout: log_event in loc de print cu email (idem
  notify degradat)
- ratelimit: sterge cheile fara timestamp-uri valide (crestere monotona
  a memoriei pe IP-uri reale)
- backup criptat SQLite (backup online API, gpg AES256) + verificare
  restore + docs/backup.md

Suita completa verde: 1557 passed, 1 skipped (live).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_signup_notify.py

@@ -155,16 +155,33 @@ def test_primul_signup_devine_admin(client):
 # Teste C16 (log SIGNUP pastrat) si best-effort E2E
 # ---------------------------------------------------------------------------
 
-def test_signup_inca_logheaza_si_notifica(client, capsys):
-    """Signup reusit -> stdout contine 'SIGNUP cont=' (C16 pastrat)."""
+def test_signup_logheaza_fara_pii_in_stdout(client, capsys):
+    """Signup reusit -> NU se mai printeaza email-ul in clar in stdout (P2-7).
+
+    C16 (jurnalizarea signup-ului) e pastrata, dar prin `log_event` (app_events +
+    log text redactat), nu prin print() cu PII."""
     resp = _do_signup(client, "Service Log Test", "log@test.com")
     assert resp.status_code == 200
     assert "rfak_" in resp.text
 
     captured = capsys.readouterr()
-    assert "SIGNUP cont=" in captured.out, (
-        f"Linia de log C16 'SIGNUP cont=' lipseste din stdout. Capturat: {captured.out!r}"
+    assert "log@test.com" not in captured.out, (
+        f"Emailul nu trebuie sa apara in clar in stdout. Capturat: {captured.out!r}"
     )
+    assert "SIGNUP cont=" not in captured.out, (
+        "Print-ul vechi cu PII nu mai trebuie sa existe."
+    )
+
+    from app.db import get_connection
+    conn = get_connection()
+    try:
+        row = conn.execute(
+            "SELECT account_id, tip FROM app_events WHERE tip='signup' ORDER BY id DESC LIMIT 1"
+        ).fetchone()
+    finally:
+        conn.close()
+    assert row is not None, "Trebuie sa existe un eveniment 'signup' in app_events"
+    assert row["tip"] == "signup"
 
 
 def test_signup_neblocat_de_notify(monkeypatch, client):