feat: harden public self-hosting deployment and CI

[ThomasNowHere]

Summary

Hardens the standalone public self-hosting template across collaboration, AI proxying, Docker deployment, SQLite recovery, dependency provenance, security automation, operational documentation, and fail-closed CI enforcement.

The shared runtime remains sourced from domternal-pro/examples/self-hosting/, while this repository preserves the standalone public npm installation and deployment model intended for users to clone and customize.

The registry-produced collab-server/package-lock.json is intentionally not included yet because @domternal-pro/core@0.1.0 and @domternal-pro/extension-comments@0.1.0 are not publicly available. CI stops at that explicit boundary instead of accepting a private workspace lock, vendored tarballs, or an unverified hand-written artifact.

Features

• Add production-oriented Docker and Compose configurations with exact Node images, default-deny build contexts, non-root runtimes, read-only filesystems, dropped capabilities, isolated networks, bounded temporary storage and logs, health checks, graceful shutdown, loopback-only ports, and file-backed secrets.
• Add WAL-safe SQLite integrity checking, checkpointing, backup, restore, compaction, rollback protection, legacy-volume ownership recovery, tests, and operational documentation.
• Add an isolated container E2E environment covering mounted secrets, native SQLite, persistence, restart, backup and restore, REST, WebSocket, webhooks, AI streaming, CORS, error handling, runtime artifacts, licenses, and cleanup.
• Add dependency-free policy, syntax, lockfile, artifact, and SQLite test suites.
• Add SHA-pinned CI workflows for static policy, frozen npm provenance, native amd64 and arm64 container verification, CodeQL, dependency review, and Trivy vulnerability scanning.
• Add weekly Dependabot checks for npm, Docker, and GitHub Actions dependencies.

Fix

• Strengthen collaboration authentication, document authorization, document-name validation, REST request handling, WebSocket limits, persistence, webhook delivery, shutdown, and error handling.
• Strengthen AI proxy authentication, origin validation, upstream URL policy, secret loading, request limits, streaming integrity, timeout behavior, provider errors, and shutdown.
• Prevent placeholder credentials, unsafe production authorization defaults, insecure upstream transport, unbounded secret files, malformed origins, and sensitive query material from reaching logs.
• Ensure mounted secret files remain readable by the non-root containers without weakening host directory protection.
• Preserve committed WAL data during backup, restore, rollback, restart, and legacy-volume recovery.
• Prevent private workspace links, mutable dependency ranges, untrusted registries, authentication material, and unverifiable artifacts from entering the public deployment lock.

Changes

• Pin the supported runtime to Node 22.23.2 and require exact production dependency versions.
• Require a real public-registry package-lock.json before frozen installs, package audits, Docker builds, or container verification can proceed.
• Install dependencies without lifecycle scripts, then build only the reviewed native better-sqlite3 dependency from source.
• Verify public registry origins, SHA-512 lockfile integrity, complete dependency closure, runtime artifacts, native SQLite, commercial notices, and license files.
• Build and test native amd64 and arm64 images once the real registry lock exists.
• Inventory all amd64 container vulnerabilities and block fixable high or critical findings.
• Keep GitHub Actions permissions read-only by default and prevent checkout credentials from persisting.
• Document deployment, customization boundaries, production authorization requirements, backups, restores, upgrades, rollback, intentional deletion, release ordering, and Pro-to-public mirror ownership.
• No workflow publishes npm packages, deploys services, logs into a container registry, or pushes Docker images.

Verified

• Ran node --test tests/*.test.mjs: 46 tests passed, 0 failed, and 3 registry-dependent SQLite tests were skipped.
• Confirmed the branch is clean and passes git diff --check.
• Verified the mirrored source-of-truth implementation in Pro with 106 focused self-hosting Playwright tests.
• Verified the Pro source-of-truth container E2E across security, SQLite, WebSocket, webhook, REST, AI proxy, persistence, recovery, and runtime artifact contracts.
• The standalone public frozen npm install, public Docker builds, amd64 and arm64 container E2E, and Trivy gates are intentionally not claimed as passed. They remain blocked until both required Pro packages are published and the real registry-produced lockfile is committed.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.