Phase 1: Fix all critical release blockers (B1-B10)

B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports

Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.

.env.docker.example

@@ -15,23 +15,48 @@ POSTGRES_USER=crm_user
 POSTGRES_PASSWORD=STRONG_PASSWORD_HERE
 POSTGRES_DB=crm_db
 
-# --- CRM Application ----------------------------------------------------------
-# The host "postgres" is the docker-compose service name (internal DNS).
-# The DRIVER is asyncpg for production PostgreSQL.
-DATABASE_URL=postgresql+asyncpg://crm_user:STRONG_PASSWORD_HERE@postgres:5432/crm_db
+# --- Redis (REQUIRED) ---------------------------------------------------------
+# Generate a strong password:
+#   python -c "import secrets; print(secrets.token_urlsafe(24))"
+REDIS_PASSWORD=STRONG_REDIS_PASSWORD_HERE
 
-# --- AUTH_SECRET (REQUIRED, min 32 chars) ------------------------------------
+# --- CRM Application: Runtime DB user (NOSUPERUSER, NOBYPASSRLS) --------------
+# The app and worker use crm_runtime — RLS is enforced.
+# This user is created by migration 0044 with DML-only permissions.
+# Set RUNTIME_DB_PASSWORD to the password you want for crm_runtime.
+RUNTIME_DB_PASSWORD=STRONG_RUNTIME_PASSWORD_HERE
+DATABASE_URL=postgresql+asyncpg://crm_runtime:STRONG_RUNTIME_PASSWORD_HERE@postgres:5432/crm_db
+
+# --- CRM Application: Migration DB user (owner, can run DDL) -----------------
+# Migrations and DDL operations use the owner user (crm_user).
+# This is NOT used by the app at runtime — only by prestart.sh / alembic.
+MIGRATION_DATABASE_URL=postgresql+asyncpg://crm_user:STRONG_PASSWORD_HERE@postgres:5432/crm_db
+
+# --- SECRET_KEY (REQUIRED, min 32 chars) -------------------------------------
 # Session signing secret. MUST be at least 32 characters.
 # Generate with:
 #   python -c "import secrets; print(secrets.token_urlsafe(48))"
-AUTH_SECRET=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx
+SECRET_KEY=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx
+
+# --- Frontend URL (for email links) ------------------------------------------
+# The public URL where users access the LeoCRM frontend.
+# Used for password reset links, invitations, etc.
+FRONTEND_URL=https://crm.example.com
 
 # --- CORS / environment -------------------------------------------------------
 # Comma-separated, NO wildcards. In dev we allow localhost:8000 (the app) and
 # :5173 (e.g. Vite dev server). In production, restrict to the real domain.
-CORS_ORIGINS=http://localhost:8000,http://localhost:5173
+CORS_ORIGINS=https://crm.example.com
 ENVIRONMENT=production
 LOG_LEVEL=INFO
 
-# --- bcrypt tuning (keep aligned with .env.example) --------------------------
+# --- SMTP (for password reset emails) -----------------------------------------
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_USERNAME=noreply@example.com
+SMTP_PASSWORD=YOUR_SMTP_PASSWORD
+SMTP_FROM_EMAIL=noreply@example.com
+SMTP_USE_TLS=true
+
+# --- bcrypt tuning ----------------------------------------------------------
 BCRYPT_ROUNDS=12