Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

docker-compose.yml

@@ -55,22 +55,26 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+      redis:
+        condition: service_healthy
     environment:
       # Use the internal docker-compose DNS name "postgres" (NOT localhost)
       DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
-      AUTH_SECRET: ${AUTH_SECRET:?AUTH_SECRET is required (min 32 chars)}
+      REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD:-changeme}@redis:6379/0}
+      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
       # Frontend served from same origin in production; allow local dev hosts too
       CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:8000,http://localhost:5173}
       ENVIRONMENT: ${ENVIRONMENT:-production}
       LOG_LEVEL: ${LOG_LEVEL:-INFO}
-      # JWT settings — keep aligned with .env.example
-      JWT_ALGORITHM: ${JWT_ALGORITHM:-HS256}
-      JWT_EXPIRY_HOURS: ${JWT_EXPIRY_HOURS:-24}
+      SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-true}
+      STORAGE_PATH: ${STORAGE_PATH:-/data/storage}
       BCRYPT_ROUNDS: ${BCRYPT_ROUNDS:-12}
     ports:
       - "8000:8000"
+    volumes:
+      - storage:/data/storage
     healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8000/health"]
+      test: ["CMD", "curl", "-fsS", "http://localhost:8000/api/v1/health"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -78,9 +82,71 @@ services:
     networks:
       - crm-net
 
+  # -------------------------------------------------------------------------
+  # CRM Worker — ARQ background worker (same image, different entrypoint).
+  # Runs migrations? No — the API container handles migrations.
+  # Scale with `docker compose up --scale crm-worker=N`.
+  # Cron jobs use a Redis-based distributed lock so only one replica fires.
+  # -------------------------------------------------------------------------
+  crm-worker:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: crm-worker
+    restart: unless-stopped
+    entrypoint: ["/app/worker.sh"]
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    environment:
+      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
+      REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD:-changeme}@redis:6379/0}
+      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
+      ENVIRONMENT: ${ENVIRONMENT:-production}
+      LOG_LEVEL: ${LOG_LEVEL:-INFO}
+      STORAGE_PATH: ${STORAGE_PATH:-/data/storage}
+      BCRYPT_ROUNDS: ${BCRYPT_ROUNDS:-12}
+    volumes:
+      - storage:/data/storage
+    healthcheck:
+      # Check if the ARQ worker process is alive
+      test: ["CMD-SHELL", "pgrep -f \"arq app.core.worker.WorkerSettings\" || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    networks:
+      - crm-net
+
+  # -------------------------------------------------------------------------
+  # Redis 7 (Alpine) — sessions, rate limiting, ARQ queue.
+  # -------------------------------------------------------------------------
+  redis:
+    image: redis:7-alpine
+    container_name: crm-redis
+    restart: unless-stopped
+    command: redis-server --requirepass ${REDIS_PASSWORD:-changeme}
+    volumes:
+      - redisdata:/data
+    ports:
+      - "6379:6379"   # local-only convenience; remove for prod-like runs
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-changeme}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - crm-net
+
 volumes:
   pgdata:
     name: crm_pgdata
+  redisdata:
+    name: crm_redisdata
+  storage:
+    name: crm_storage
 
 networks:
   crm-net: