fix: address project review findings

Security and robustness:
- storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware)
- api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP)
- /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout
- storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout
- goose migrations take a Postgres advisory lock
- recommender readyz: per-check timeout, redis socket timeouts

Clients:
- Android release allows cleartext HTTP for LAN servers (expo-build-properties)
- checkServer times out after 10s; connect button is disabled while checking

Deploy and CI:
- install.sh hands cache/uploads/updates/models to the non-root service users
- update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1
- recommender/analyzer get only the env they need; required secrets fail fast
- nginx security headers and CSP; strip True-Client-IP
- dev compose binds ports to 127.0.0.1; postgres/redis images pinned
- version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev
- contract check catches untracked generated files
- final releases fail without a release keystore; changelog skips rc tags

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose.yaml

@@ -45,7 +45,7 @@ services:
       args: *version
     env_file: .env
     environment: &db-env
-      DATABASE_URL: postgres://pipu:${POSTGRES_PASSWORD}@postgres:5432/pipu?sslmode=disable
+      DATABASE_URL: postgres://pipu:${POSTGRES_PASSWORD:?заполните POSTGRES_PASSWORD в .env (sudo ./install.sh)}@postgres:5432/pipu?sslmode=disable
     volumes:
       - *library-ro
       - ${PIPU_DATA:-/srv/pipu}/cache:/cache
@@ -67,8 +67,9 @@ services:
     cap_add: [SYS_ADMIN]
     security_opt: ["apparmor:unconfined"]
     environment:
-      INTERNAL_TOKEN: ${INTERNAL_TOKEN}
+      INTERNAL_TOKEN: ${INTERNAL_TOKEN:?заполните INTERNAL_TOKEN в .env (sudo ./install.sh)}
       LIBRARY_ROOT: /library
+      LOG_LEVEL: ${LOG_LEVEL:-info}
     volumes:
       - type: bind
         source: ${PIPU_DATA:-/srv/pipu}/library
@@ -81,8 +82,12 @@ services:
     image: pipu-music-recommender:${PIPU_VERSION:-dev}
     build: *build-rec
     command: ["serve"]
-    env_file: .env
-    environment: *db-env
+    # только нужные переменные, а не весь .env с секретами Meilisearch и Gitea
+    environment:
+      <<: *db-env
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
+      INTERNAL_TOKEN: ${INTERNAL_TOKEN:?заполните INTERNAL_TOKEN в .env (sudo ./install.sh)}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
     depends_on:
       postgres: { condition: service_healthy }
 
@@ -91,8 +96,10 @@ services:
     image: pipu-music-recommender:${PIPU_VERSION:-dev}
     build: *build-rec
     command: ["analyze", "--workers", "4"]
-    env_file: .env
-    environment: *db-env
+    environment:
+      <<: *db-env
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
     volumes:
       - *library-ro
       - ${PIPU_DATA:-/srv/pipu}/models:/models
@@ -102,7 +109,7 @@ services:
 
   postgres:
     <<: *restart
-    image: pgvector/pgvector:pg17
+    image: pgvector/pgvector:0.8.7-pg17
     environment:
       POSTGRES_USER: pipu
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
@@ -115,7 +122,7 @@ services:
 
   redis:
     <<: *restart
-    image: redis:7-alpine
+    image: redis:7.4-alpine
     command: ["redis-server", "--appendonly", "yes"]
     volumes: [ "${PIPU_DATA:-/srv/pipu}/redis:/data" ]