fix: address project review findings

Security and robustness:
- storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware)
- api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP)
- /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout
- storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout
- goose migrations take a Postgres advisory lock
- recommender readyz: per-check timeout, redis socket timeouts

Clients:
- Android release allows cleartext HTTP for LAN servers (expo-build-properties)
- checkServer times out after 10s; connect button is disabled while checking

Deploy and CI:
- install.sh hands cache/uploads/updates/models to the non-root service users
- update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1
- recommender/analyzer get only the env they need; required secrets fail fast
- nginx security headers and CSP; strip True-Client-IP
- dev compose binds ports to 127.0.0.1; postgres/redis images pinned
- version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev
- contract check catches untracked generated files
- final releases fail without a release keystore; changelog skips rc tags

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/storageagent/router.go

@@ -5,6 +5,7 @@ package storageagent
 import (
 	"crypto/subtle"
 	"encoding/json"
+	"log/slog"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -21,8 +22,12 @@ type Mount struct {
 	Path     string `json:"path"`
 }
 
-// NewRouter возвращает роутер агента. token — общий секрет INTERNAL_TOKEN.
-func NewRouter(token, libraryRoot string) http.Handler {
+// NewRouter возвращает роутер агента. token — общий секрет INTERNAL_TOKEN;
+// при пустом token все запросы к /internal отклоняются.
+func NewRouter(log *slog.Logger, token, libraryRoot string) http.Handler {
+	if log == nil {
+		log = slog.New(slog.DiscardHandler)
+	}
 	r := chi.NewRouter()
 	r.NotFound(httpx.NotFound)
 	r.Get("/healthz", func(w http.ResponseWriter, _ *http.Request) {
@@ -30,10 +35,11 @@ func NewRouter(token, libraryRoot string) http.Handler {
 	})
 	r.Route("/internal", func(r chi.Router) {
 		r.Use(requireToken(token))
-		r.Get("/mounts", func(w http.ResponseWriter, _ *http.Request) {
+		r.Get("/mounts", func(w http.ResponseWriter, r *http.Request) {
 			mounts, err := listMounts(libraryRoot)
 			if err != nil {
-				httpx.WriteProblem(w, http.StatusInternalServerError, "storage.list_failed", err.Error())
+				log.ErrorContext(r.Context(), "list mounts", "err", err)
+				httpx.WriteProblem(w, http.StatusInternalServerError, "storage.list_failed", "cannot list mounts")
 				return
 			}
 			writeJSON(w, http.StatusOK, map[string]any{"mounts": mounts})
@@ -46,7 +52,7 @@ func requireToken(token string) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			got, ok := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
-			if !ok || subtle.ConstantTimeCompare([]byte(got), []byte(token)) != 1 {
+			if !ok || token == "" || subtle.ConstantTimeCompare([]byte(got), []byte(token)) != 1 {
 				httpx.WriteProblem(w, http.StatusUnauthorized, "auth.invalid_internal_token", "invalid internal token")
 				return
 			}

services/api/internal/storageagent/router_test.go

@@ -13,7 +13,7 @@ import (
 )
 
 func TestInternalRequiresToken(t *testing.T) {
-	h := NewRouter("secret", t.TempDir())
+	h := NewRouter(nil, "secret", t.TempDir())
 
 	for _, auth := range []string{"", "Bearer wrong", "secret"} {
 		rec := httptest.NewRecorder()
@@ -26,6 +26,18 @@ func TestInternalRequiresToken(t *testing.T) {
 	}
 }
 
+func TestInternalRejectsEverythingWithEmptyToken(t *testing.T) {
+	h := NewRouter(nil, "", t.TempDir())
+
+	for _, auth := range []string{"", "Bearer ", "Bearer x"} {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/internal/mounts", nil)
+		req.Header.Set("Authorization", auth)
+		h.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusUnauthorized, rec.Code, "auth=%q", auth)
+	}
+}
+
 func TestListMounts(t *testing.T) {
 	root := t.TempDir()
 	require.NoError(t, os.Mkdir(filepath.Join(root, "src-1"), 0o755))
@@ -34,7 +46,7 @@ func TestListMounts(t *testing.T) {
 	rec := httptest.NewRecorder()
 	req := httptest.NewRequest(http.MethodGet, "/internal/mounts", nil)
 	req.Header.Set("Authorization", "Bearer secret")
-	NewRouter("secret", root).ServeHTTP(rec, req)
+	NewRouter(nil, "secret", root).ServeHTTP(rec, req)
 
 	require.Equal(t, http.StatusOK, rec.Code)
 	var body struct{ Mounts []Mount }