fix: address project review findings

Security and robustness:
- storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware)
- api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP)
- /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout
- storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout
- goose migrations take a Postgres advisory lock
- recommender readyz: per-check timeout, redis socket timeouts

Clients:
- Android release allows cleartext HTTP for LAN servers (expo-build-properties)
- checkServer times out after 10s; connect button is disabled while checking

Deploy and CI:
- install.sh hands cache/uploads/updates/models to the non-root service users
- update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1
- recommender/analyzer get only the env they need; required secrets fail fast
- nginx security headers and CSP; strip True-Client-IP
- dev compose binds ports to 127.0.0.1; postgres/redis images pinned
- version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev
- contract check catches untracked generated files
- final releases fail without a release keystore; changelog skips rc tags

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/recommender/pipu_rec/api/app.py

@@ -1,6 +1,8 @@
 """FastAPI-приложение внутреннего API рекомендаций."""
 
+import asyncio
 import hmac
+import logging
 from collections.abc import Awaitable, Callable
 from typing import Annotated
 
@@ -11,6 +13,10 @@ from pipu_rec.settings import Settings
 
 Check = Callable[[], Awaitable[None]]
 
+log = logging.getLogger(__name__)
+
+CHECK_TIMEOUT_S = 2.0
+
 
 def create_app(settings: Settings, checks: dict[str, Check] | None = None) -> FastAPI:
     app = FastAPI(title="pipu-recommender", version=settings.version, docs_url=None, redoc_url=None)
@@ -26,15 +32,20 @@ def create_app(settings: Settings, checks: dict[str, Check] | None = None) -> Fa
     async def healthz() -> dict[str, str]:
         return {"status": "ok"}
 
+    async def run_check(name: str, check: Check) -> str:
+        try:
+            await asyncio.wait_for(check(), CHECK_TIMEOUT_S)
+        except Exception as exc:
+            log.warning("readiness check %s failed: %r", name, exc)
+            return "fail"
+        return "ok"
+
     @app.get("/readyz")
     async def readyz() -> JSONResponse:
-        results: dict[str, str] = {}
-        for name, check in checks.items():
-            try:
-                await check()
-                results[name] = "ok"
-            except Exception as exc:
-                results[name] = str(exc) or type(exc).__name__
+        # Проверки параллельные, каждая ограничена таймаутом; причину ошибки пишем только в лог.
+        names = list(checks)
+        outcomes = await asyncio.gather(*(run_check(n, checks[n]) for n in names))
+        results = dict(zip(names, outcomes, strict=True))
         healthy = all(v == "ok" for v in results.values())
         return JSONResponse(
             {"status": "ok" if healthy else "degraded", "checks": results},

services/recommender/pipu_rec/cli.py

@@ -15,7 +15,7 @@ log = logging.getLogger("pipu_rec")
 
 
 def _serve(settings: Settings) -> None:
-    rdb = aioredis.Redis.from_url(settings.redis_url)
+    rdb = aioredis.Redis.from_url(settings.redis_url, socket_connect_timeout=2, socket_timeout=2)
 
     async def check_postgres() -> None:
         async with await psycopg.AsyncConnection.connect(settings.database_url, connect_timeout=2) as conn:

services/recommender/tests/test_app.py

@@ -32,7 +32,21 @@ def test_readyz_all_up() -> None:
 def test_readyz_dependency_down() -> None:
     r = client({"postgres": ok, "redis": down}).get("/readyz")
     assert r.status_code == 503
-    assert r.json()["checks"]["redis"] == "connection refused"
+    assert r.json()["checks"]["redis"] == "fail"
+
+
+def test_readyz_dependency_hangs(monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    import asyncio
+
+    from pipu_rec.api import app as app_module
+
+    async def hang() -> None:
+        await asyncio.sleep(10)
+
+    monkeypatch.setattr(app_module, "CHECK_TIMEOUT_S", 0.05)
+    r = client({"postgres": ok, "redis": hang}).get("/readyz")
+    assert r.status_code == 503
+    assert r.json()["checks"] == {"postgres": "ok", "redis": "fail"}
 
 
 def test_internal_status_requires_token() -> None: