production hardening: future-date guard, per-day hour cap, totalHours in history, header cleanup

docker/docker-compose.yml

@@ -7,7 +7,7 @@ services:
     restart: unless-stopped
     environment:
       POSTGRES_USER: coastal
-      POSTGRES_PASSWORD: ${DB_PASSWORD:-coastal_secret}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD must be set in .env}
       POSTGRES_DB: coastal_timesheet
     volumes:
       - pgdata:/var/lib/postgresql/data
@@ -34,12 +34,12 @@ services:
       db:
         condition: service_healthy
     environment:
-      DATABASE_URL: postgresql://coastal:${DB_PASSWORD:-coastal_secret}@db:5432/coastal_timesheet
-      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-jwt-secret-2026}
-      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:-change-me-in-production-refresh-secret-2026}
+      DATABASE_URL: postgresql://coastal:${DB_PASSWORD:?DB_PASSWORD must be set}@db:5432/coastal_timesheet
+      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in .env}
+      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:?JWT_REFRESH_SECRET must be set in .env}
       PORT: '3004'
       NODE_ENV: production
-      CORS_ORIGINS: https://ts.bizzle.cloud,http://localhost
+      CORS_ORIGINS: https://ts.bizzle.cloud,http://localhost:5173,http://localhost:3000
       SMTP_HOST: ${SMTP_HOST:-}
       SMTP_PORT: ${SMTP_PORT:-587}
       SMTP_USER: ${SMTP_USER:-}
@@ -47,8 +47,7 @@ services:
       SMTP_FROM: ${SMTP_FROM:-}
       ADMIN_EMAIL: ${ADMIN_EMAIL:-bizzle@coastalcontracting.com}
     ports:
-      - '127.0.0.1:3004:3004'
-      - '172.18.0.1:3004:3004'
+      - '127.0.0.1:3005:3004'
     healthcheck:
       test: ['CMD', 'node', '-e', "fetch('http://localhost:3004/api/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
       interval: 15s