fix: address project review findings

Security and robustness:
- storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware)
- api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP)
- /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout
- storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout
- goose migrations take a Postgres advisory lock
- recommender readyz: per-check timeout, redis socket timeouts

Clients:
- Android release allows cleartext HTTP for LAN servers (expo-build-properties)
- checkServer times out after 10s; connect button is disabled while checking

Deploy and CI:
- install.sh hands cache/uploads/updates/models to the non-root service users
- update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1
- recommender/analyzer get only the env they need; required secrets fail fast
- nginx security headers and CSP; strip True-Client-IP
- dev compose binds ports to 127.0.0.1; postgres/redis images pinned
- version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev
- contract check catches untracked generated files
- final releases fail without a release keystore; changelog skips rc tags

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/version.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 // Вычисляет версию продукта из git-тега (docs/ci-cd.md#версионирование).
-//   node scripts/version.mjs v1.2.3        → печатает KEY=VALUE (для $GITHUB_ENV / $GITHUB_OUTPUT)
-//   node scripts/version.mjs               → берёт GITHUB_REF_NAME, иначе 0.0.0-dev
+//   node scripts/version.mjs v1.2.3        → печатает KEY=VALUE (для $GITHUB_ENV / $GITHUB_OUTPUT);
+//                                            тег не по формату — ошибка (релиз не должен стать 0.0.0-dev)
+//   node scripts/version.mjs               → берёт GITHUB_REF_NAME, если это релизный тег, иначе 0.0.0-dev
 //
 // Android versionCode = MAJOR·1 000 000 + MINOR·10 000 + PATCH·100 + (99 для релиза | N для -rc.N),
 // поэтому 1.2.0-rc.1 < 1.2.0-rc.2 < 1.2.0 < 1.2.1.
@@ -23,9 +24,23 @@ export function parseVersion(tag) {
   return { version, versionCode, prerelease: rc !== null };
 }
 
+const DEV = { version: '0.0.0-dev', versionCode: 1, prerelease: true };
+
+export function resolveVersion(argTag, refName) {
+  if (argTag !== undefined) return parseVersion(argTag);
+  const ref = refName ?? '';
+  return TAG_RE.test(ref) ? parseVersion(ref) : DEV;
+}
+
 function main() {
-  const tag = process.argv[2] ?? process.env.GITHUB_REF_NAME ?? '';
-  const v = TAG_RE.test(tag) ? parseVersion(tag) : { version: '0.0.0-dev', versionCode: 1, prerelease: true };
+  let v;
+  try {
+    v = resolveVersion(process.argv[2], process.env.GITHUB_REF_NAME);
+  } catch (e) {
+    process.stderr.write(`${e.message}
+`);
+    process.exit(1);
+  }
   process.stdout.write(
     `PIPU_VERSION=${v.version}\nPIPU_VERSION_CODE=${v.versionCode}\nPIPU_PRERELEASE=${v.prerelease}\n`,
   );

scripts/version.test.mjs

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 
-import { parseVersion } from './version.mjs';
+import { parseVersion, resolveVersion } from './version.mjs';
 
 test('release tag', () => {
   assert.deepEqual(parseVersion('v0.1.0'), { version: '0.1.0', versionCode: 10_099, prerelease: false });
@@ -23,3 +23,14 @@ test('rejects malformed tags', () => {
     assert.throws(() => parseVersion(tag), undefined, tag);
   }
 });
+
+test('explicit tag must be a release tag', () => {
+  assert.throws(() => resolveVersion('v1.2.3-beta', undefined));
+  assert.equal(resolveVersion('v1.2.3', 'main').version, '1.2.3');
+});
+
+test('branch builds fall back to the dev version', () => {
+  assert.equal(resolveVersion(undefined, 'main').version, '0.0.0-dev');
+  assert.equal(resolveVersion(undefined, undefined).version, '0.0.0-dev');
+  assert.equal(resolveVersion(undefined, 'v2.0.0').version, '2.0.0');
+});