Phase 9: production hardening

Config via env, abuse/resource limits, and production serving so the app
is safe to expose publicly:

- Fail-fast on missing SECRET_KEY when MULTI_USER=true
- quickjs per-execution time/memory limits (while(true) can't hang server)
- Per-user/per-IP rate limiting on turn/script/auth endpoints
- Request body size limit + per-user row caps
- Security headers (CSP, X-Frame-Options, nosniff, referrer-policy) incl. SSE
- Debug router 403 and /docs disabled in multi-user mode
- DATABASE_URL support (defaults to Neon Postgres) alongside SQLite
- Documented all env vars in backend/.env.example

Verified locally via uvicorn (MULTI_USER=1, SQLite); see plan/09-phase-hardening.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017e6tQuojBLYPetUfmhit4X

backend/app/routers/auth.py

@@ -3,7 +3,7 @@ import re
 from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from sqlalchemy.orm import Session
 
-from .. import auth, models, schemas, security
+from .. import auth, limits, models, schemas, security
 from ..database import get_db
 from .settings import get_settings
 
@@ -53,6 +53,8 @@ def me(request: Request, response: Response, db: Session = Depends(get_db)):
     else:
         user = auth.resolve_session_user(request, db)
         if user is None:
+            # Each new guest is a database row — cap how fast one IP can mint them.
+            limits.rate_limit("guest", request)
             user = models.User(is_guest=True)
             db.add(user)
             db.commit()
@@ -71,7 +73,7 @@ def register(
     scenario, script and setting they created as a guest is kept."""
     if not auth.MULTI_USER:
         raise HTTPException(400, "Accounts are disabled in local mode.")
-    auth.rate_limit_auth(request)
+    limits.rate_limit("auth", request)
     email = payload.email.strip().lower()
     if not EMAIL_RE.match(email):
         raise HTTPException(422, "Enter a valid email address.")
@@ -99,7 +101,7 @@ def login(
     session is simply abandoned (its data stays under the guest user)."""
     if not auth.MULTI_USER:
         raise HTTPException(400, "Accounts are disabled in local mode.")
-    auth.rate_limit_auth(request)
+    limits.rate_limit("auth", request)
     email = payload.email.strip().lower()
     user = db.query(models.User).filter(models.User.email == email).first()
     if (