feat(api): implement caching and logging in health check endpoint (#526)

* feat(api): implement caching and logging in health check endpoint

- Added in-memory caching for health check responses to reduce load on Postgres.
- Introduced logging for error handling in health check.
- Updated response structure to exclude error details from public responses.

feat(api): enhance OAuth consent UI and scope handling

- Improved consent UI to reflect exact requested scopes and added better user guidance.
- Updated scope handling logic to ensure least-privilege access.
- Enhanced styling for better user experience and accessibility.

chore(docker): improve security and resource management in Docker setup

- Updated Docker Compose configuration to enforce read-only file systems and resource limits.
- Added health checks and logging options for better observability.
- Introduced optional Caddy reverse proxy for TLS termination.

fix(migrations): resolve ambiguity in create_company_with_owner function

- Dropped orphaned 3-arg overload of create_company_with_owner function.
- Recreated canonical 4-arg version with cash account seeding logic.
- Ensured proper permissions for function execution in Postgres.

* feat: enhance security checks for team membership in company creation

docker/Caddyfile

@@ -0,0 +1,11 @@
+{$DOMAIN} {
+	reverse_proxy app:3000
+
+	# HSTS: lock clients onto HTTPS for one year.
+	# `preload` is intentionally omitted — submission to browser preload lists
+	# is irreversible on short timescales (months of lead time to remove a
+	# domain). Operators who want preload eligibility can add the directive
+	# after committing to HTTPS-only permanently and submitting via
+	# hstspreload.org.
+	header Strict-Transport-Security "max-age=31536000; includeSubDomains"
+}

docker/cron.Dockerfile

@@ -1,13 +1,32 @@
-FROM alpine:3.19
+FROM alpine:3.22@sha256:310c62b5e7ca5b08167e4384c68db0fd2905dd9c7493756d356e893909057601
 
 ARG SUPERCRONIC_VERSION=v0.2.33
 ARG TARGETARCH
 
+# SHA-256 of the supercronic v0.2.33 release binaries.
+# Computed from https://github.com/aptible/supercronic/releases/download/v0.2.33/
+# (the upstream project publishes only SHA-1 checksums, so these are recorded here).
+# Dependabot watches FROM lines, not these ARGs — bump manually when SUPERCRONIC_VERSION changes.
+ARG SUPERCRONIC_SHA256_AMD64=feefa310da569c81b99e1027b86b27b51e6ee9ab647747b49099645120cfc671
+ARG SUPERCRONIC_SHA256_ARM64=f1f8585c66de020fef494dd636058f99949d108f569fef00016a1c8b9eb145b3
+
+# curl stays in the image — the crontab uses it at runtime to call the app.
 RUN apk add --no-cache curl \
-    && ARCH=$(case ${TARGETARCH} in amd64) echo "linux-amd64";; arm64) echo "linux-arm64";; *) echo "linux-amd64";; esac) \
+    && case ${TARGETARCH} in \
+         amd64) ARCH=linux-amd64; SHA=${SUPERCRONIC_SHA256_AMD64} ;; \
+         arm64) ARCH=linux-arm64; SHA=${SUPERCRONIC_SHA256_ARM64} ;; \
+         *)     ARCH=linux-amd64; SHA=${SUPERCRONIC_SHA256_AMD64} ;; \
+       esac \
     && curl -fsSL "https://github.com/aptible/supercronic/releases/download/${SUPERCRONIC_VERSION}/supercronic-${ARCH}" \
        -o /usr/local/bin/supercronic \
-    && chmod +x /usr/local/bin/supercronic
+    && echo "${SHA}  /usr/local/bin/supercronic" | sha256sum -c - \
+    && chmod 0755 /usr/local/bin/supercronic
+
+# Run as the alpine-built-in unprivileged user. Defense-in-depth alongside
+# cap_drop:[ALL] and read_only:true in docker-compose.yml. The crontab is
+# bind-mounted read-only with default 644 perms (readable by all), and the
+# supercronic binary is world-executable (chmod 0755 above).
+USER nobody:nobody
 
 ENTRYPOINT ["supercronic"]
 CMD ["/etc/supercronic/crontab"]