fix: address project review findings

Security and robustness:
- storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware)
- api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP)
- /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout
- storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout
- goose migrations take a Postgres advisory lock
- recommender readyz: per-check timeout, redis socket timeouts

Clients:
- Android release allows cleartext HTTP for LAN servers (expo-build-properties)
- checkServer times out after 10s; connect button is disabled while checking

Deploy and CI:
- install.sh hands cache/uploads/updates/models to the non-root service users
- update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1
- recommender/analyzer get only the env they need; required secrets fail fast
- nginx security headers and CSP; strip True-Client-IP
- dev compose binds ports to 127.0.0.1; postgres/redis images pinned
- version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev
- contract check catches untracked generated files
- final releases fail without a release keystore; changelog skips rc tags

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/core/src/index.ts

@@ -1 +1 @@
-export { checkServer, normalizeServerUrl, type ServerCheck } from './server';
+export { checkServer, normalizeServerUrl, SERVER_CHECK_TIMEOUT_MS, type ServerCheck } from './server';

packages/core/src/server.test.ts

@@ -52,6 +52,11 @@ describe('checkServer', () => {
     expect(res).toEqual({ status: 'offline', error: 'Failed to fetch' });
   });
 
+  it('reports offline when the server does not answer in time', async () => {
+    const client = createApiClient({ baseUrl: 'https://music.test', fetch: () => new Promise<Response>(() => {}) });
+    await expect(checkServer(client, undefined, 20)).resolves.toEqual({ status: 'offline', error: 'timeout' });
+  });
+
   it('reports offline with the problem code on API errors', async () => {
     const res = await checkServer(clientReturning(() => json({ status: 500, code: 'common.internal' }, 500)));
     expect(res).toEqual({ status: 'offline', error: 'common.internal' });

packages/core/src/server.ts

@@ -25,19 +25,42 @@ export type ServerCheck =
   | { status: 'unsupported_app'; info: ServerInfo }
   | { status: 'offline'; error: string };
 
+/** Сколько ждать ответа сервера, прежде чем считать его недоступным. */
+export const SERVER_CHECK_TIMEOUT_MS = 10_000;
+
 /**
  * Проверяет сервер через GET /api/v1/server-info.
  * appVersionCode — versionCode Android-клиента; для веба не передаётся.
  */
-export async function checkServer(client: ApiClient, appVersionCode?: number): Promise<ServerCheck> {
+export async function checkServer(
+  client: ApiClient,
+  appVersionCode?: number,
+  timeoutMs = SERVER_CHECK_TIMEOUT_MS,
+): Promise<ServerCheck> {
+  // Гонка с таймером, а не только abort: не каждая реализация fetch (Hermes, полифилы)
+  // надёжно прерывает запрос по сигналу. AbortSignal.timeout не используется — его может не быть в Hermes.
+  const controller = new AbortController();
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new Error('timeout'));
+    }, timeoutMs);
+  });
   try {
-    const { data, error } = await client.GET('/api/v1/server-info');
+    const { data, error } = await Promise.race([
+      client.GET('/api/v1/server-info', { signal: controller.signal }),
+      timeout,
+    ]);
     if (!data) return { status: 'offline', error: error ? error.code : 'unknown' };
     if (appVersionCode !== undefined && appVersionCode < data.min_android_version_code) {
       return { status: 'unsupported_app', info: data };
     }
     return { status: 'ok', info: data };
   } catch (e) {
+    if (controller.signal.aborted) return { status: 'offline', error: 'timeout' };
     return { status: 'offline', error: e instanceof Error ? e.message : String(e) };
+  } finally {
+    clearTimeout(timer);
   }
 }