fix: address project review findings

Security and robustness:
- storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware)
- api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP)
- /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout
- storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout
- goose migrations take a Postgres advisory lock
- recommender readyz: per-check timeout, redis socket timeouts

Clients:
- Android release allows cleartext HTTP for LAN servers (expo-build-properties)
- checkServer times out after 10s; connect button is disabled while checking

Deploy and CI:
- install.sh hands cache/uploads/updates/models to the non-root service users
- update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1
- recommender/analyzer get only the env they need; required secrets fail fast
- nginx security headers and CSP; strip True-Client-IP
- dev compose binds ports to 127.0.0.1; postgres/redis images pinned
- version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev
- contract check catches untracked generated files
- final releases fail without a release keystore; changelog skips rc tags

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose.dev.yaml

@@ -3,16 +3,17 @@
 #   docker compose -f deploy/compose.dev.yaml --profile app up  # + api и recommender из исходников
 # Затем: веб — `pnpm --filter @pipu/web dev` (проксирует /api на :8080),
 #        api без docker — см. README, раздел «Разработка».
+# Порты слушают только 127.0.0.1: у Redis нет пароля, а у dev-Postgres он известен всем.
 name: pipu-dev
 
 services:
   postgres:
-    image: pgvector/pgvector:pg17
+    image: pgvector/pgvector:0.8.7-pg17
     environment:
       POSTGRES_USER: pipu
       POSTGRES_PASSWORD: pipu
       POSTGRES_DB: pipu
-    ports: ["5432:5432"]
+    ports: ["127.0.0.1:5432:5432"]
     volumes: [pg-data:/var/lib/postgresql/data]
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U pipu -d pipu"]
@@ -20,8 +21,8 @@ services:
       retries: 10
 
   redis:
-    image: redis:7-alpine
-    ports: ["6379:6379"]
+    image: redis:7.4-alpine
+    ports: ["127.0.0.1:6379:6379"]
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 5s
@@ -32,7 +33,7 @@ services:
     environment:
       MEILI_MASTER_KEY: dev-master-key-change-me
       MEILI_ENV: development
-    ports: ["7700:7700"]
+    ports: ["127.0.0.1:7700:7700"]
     volumes: [meili-data:/meili_data]
 
   api:
@@ -45,7 +46,7 @@ services:
       DATABASE_URL: postgres://pipu:pipu@postgres:5432/pipu?sslmode=disable
       REDIS_URL: redis://redis:6379/0
       LOG_LEVEL: debug
-    ports: ["8080:8080"]
+    ports: ["127.0.0.1:8080:8080"]
     depends_on:
       postgres: { condition: service_healthy }
       redis: { condition: service_healthy }
@@ -59,7 +60,7 @@ services:
       DATABASE_URL: postgresql://pipu:pipu@postgres:5432/pipu
       REDIS_URL: redis://redis:6379/0
       INTERNAL_TOKEN: dev-internal-token
-    ports: ["8000:8000"]
+    ports: ["127.0.0.1:8000:8000"]
     depends_on:
       postgres: { condition: service_healthy }
       redis: { condition: service_healthy }