3 fixes #662 #663 #664 | assigned by param20ha

[vastavikadi]

📋 PR Checklist

Thank you for contributing to PDF-Assistant-RAG! 🎉
Please fill out this template before submitting. PRs without it filled in will be closed.

---

🔗 Related Issue

Closes #662 #663 #664

📝 What does this PR do?

• Added validate_production() method that was called in main.py lifespan but didn't exist
• Changed EncryptedString._get_cipher() from SECRET_KEY → FIELD_ENCRYPTION_KEY
• Permanent failures (corrupt PDFs, validation errors) are no longer retried
• Added pool_recycle=3600 to PostgreSQL engine to prevent stale connections
• Queries exceeding configurable threshold (default 1s) are logged as warnings
• New SecurityHeadersMiddleware adds to every API response
• Graceful Shutdown
• Input Validation Hardening
• Nginx Security Headers
• Audit Logging

---

🗂️ Type of Change

• 🐛 Bug fix
• ✨ New feature
• 🔧 Refactor / code cleanup
• 📝 Documentation update
• 🎨 UI / styling change
• ⚙️ CI / tooling / config change
• 🧪 Tests

---

🧪 How was this tested?

• Ran the backend locally (uvicorn app.main:app --reload)
• Ran the frontend locally (npm run dev inside frontend/)
• Tested the affected API endpoints manually
• Added / updated tests

---

📸 Screenshots (if UI change)

---

⚠️ Anything to flag for reviewers?

---

✅ Self-Review Checklist

• My branch is based on dev, not main
• I have not added any secrets / API keys
• I have not modified main branch or any HuggingFace deployment config
• My code follows the existing style (no unnecessary formatting changes)
• I have updated relevant docs / comments if needed

[vastavikadi]

@param20h please review the changes