fix: address project review findings

Security and robustness:
- storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware)
- api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP)
- /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout
- storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout
- goose migrations take a Postgres advisory lock
- recommender readyz: per-check timeout, redis socket timeouts

Clients:
- Android release allows cleartext HTTP for LAN servers (expo-build-properties)
- checkServer times out after 10s; connect button is disabled while checking

Deploy and CI:
- install.sh hands cache/uploads/updates/models to the non-root service users
- update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1
- recommender/analyzer get only the env they need; required secrets fail fast
- nginx security headers and CSP; strip True-Client-IP
- dev compose binds ports to 127.0.0.1; postgres/redis images pinned
- version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev
- contract check catches untracked generated files
- final releases fail without a release keystore; changelog skips rc tags

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/cmd/api/main.go

@@ -3,13 +3,10 @@ package main
 
 import (
 	"context"
-	"errors"
 	"log/slog"
-	"net/http"
 	"os"
 	"os/signal"
 	"syscall"
-	"time"
 
 	"github.com/redis/go-redis/v9"
 
@@ -63,37 +60,12 @@ func run() error {
 		Version:               buildinfo.Version,
 		SupportedLocales:      cfg.SupportedLocales,
 		MinAndroidVersionCode: cfg.MinAndroidVersionCode,
-	}, map[string]system.Checker{
+	}, log, map[string]system.Checker{
 		"postgres": system.CheckerFunc(pool.Ping),
 		"redis":    system.CheckerFunc(func(ctx context.Context) error { return rdb.Ping(ctx).Err() }),
 	})
 
-	srv := &http.Server{
-		Addr:              cfg.HTTPAddr,
-		Handler:           server.NewRouter(server.Deps{Log: log, System: sys}),
-		ReadHeaderTimeout: 10 * time.Second,
-	}
-	return serve(ctx, log, srv, cfg.ShutdownTimeout)
-}
-
-func serve(ctx context.Context, log *slog.Logger, srv *http.Server, shutdownTimeout time.Duration) error {
-	errCh := make(chan error, 1)
-	go func() {
-		log.Info("listening", "addr", srv.Addr, "version", buildinfo.Version)
-		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
-			errCh <- err
-		}
-		close(errCh)
-	}()
-
-	select {
-	case err := <-errCh:
-		return err
-	case <-ctx.Done():
-	}
-
-	log.Info("shutting down")
-	shutdownCtx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
-	defer cancel()
-	return srv.Shutdown(shutdownCtx)
+	srv := httpx.NewServer(cfg.HTTPAddr, server.NewRouter(server.Deps{Log: log, System: sys}))
+	log.Info("starting", "version", buildinfo.Version)
+	return httpx.Serve(ctx, log, srv, cfg.ShutdownTimeout)
 }

services/api/cmd/storage-agent/main.go

@@ -2,10 +2,11 @@
 package main
 
 import (
+	"context"
 	"log/slog"
-	"net/http"
 	"os"
-	"time"
+	"os/signal"
+	"syscall"
 
 	"pipu/api/internal/buildinfo"
 	"pipu/api/internal/platform/config"
@@ -14,21 +15,24 @@ import (
 )
 
 func main() {
-	cfg, err := config.Load[config.StorageAgent]()
-	if err != nil {
-		slog.Error("storage-agent: config", "err", err)
-		os.Exit(1)
-	}
-	log := httpx.NewLogger(cfg.LogLevel)
-
-	srv := &http.Server{
-		Addr:              cfg.HTTPAddr,
-		Handler:           storageagent.NewRouter(cfg.InternalToken, cfg.LibraryRoot),
-		ReadHeaderTimeout: 10 * time.Second,
-	}
-	log.Info("listening", "addr", srv.Addr, "version", buildinfo.Version)
-	if err := srv.ListenAndServe(); err != nil {
-		log.Error("storage-agent stopped", "err", err)
+	if err := run(); err != nil {
+		slog.Error("storage-agent stopped", "err", err)
 		os.Exit(1)
 	}
 }
+
+func run() error {
+	cfg, err := config.Load[config.StorageAgent]()
+	if err != nil {
+		return err
+	}
+	log := httpx.NewLogger(cfg.LogLevel)
+	slog.SetDefault(log)
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	srv := httpx.NewServer(cfg.HTTPAddr, storageagent.NewRouter(log, cfg.InternalToken, cfg.LibraryRoot))
+	log.Info("starting", "version", buildinfo.Version)
+	return httpx.Serve(ctx, log, srv, cfg.ShutdownTimeout)
+}