Phase 9: production hardening

Config via env, abuse/resource limits, and production serving so the app
is safe to expose publicly:

- Fail-fast on missing SECRET_KEY when MULTI_USER=true
- quickjs per-execution time/memory limits (while(true) can't hang server)
- Per-user/per-IP rate limiting on turn/script/auth endpoints
- Request body size limit + per-user row caps
- Security headers (CSP, X-Frame-Options, nosniff, referrer-policy) incl. SSE
- Debug router 403 and /docs disabled in multi-user mode
- DATABASE_URL support (defaults to Neon Postgres) alongside SQLite
- Documented all env vars in backend/.env.example

Verified locally via uvicorn (MULTI_USER=1, SQLite); see plan/09-phase-hardening.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017e6tQuojBLYPetUfmhit4X

backend/app/routers/settings.py

@@ -1,8 +1,8 @@
 import httpx
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request
 from sqlalchemy.orm import Session
 
-from .. import auth, models, schemas, security
+from .. import auth, limits, models, schemas, security
 from ..database import get_db
 
 router = APIRouter(prefix="/api/settings", tags=["settings"])
@@ -64,12 +64,14 @@ def update_settings(
 
 @router.post("/test")
 async def test_connection(
+    request: Request,
     db: Session = Depends(get_db),
     user: models.User = Depends(auth.get_current_user),
 ):
     """Hit the endpoint's /models listing as a cheap connectivity check.
     Tests whatever the turn engine would actually use — including the shared
     demo endpoint when the user has no key of their own."""
+    limits.rate_limit("connection-test", request, user)
     settings = get_settings(db, user)
     cfg = auth.resolve_provider_config(settings)
     url = cfg.endpoint_url.rstrip("/") + "/models"