feat(api): implement caching and logging in health check endpoint (#526)

* feat(api): implement caching and logging in health check endpoint

- Added in-memory caching for health check responses to reduce load on Postgres.
- Introduced logging for error handling in health check.
- Updated response structure to exclude error details from public responses.

feat(api): enhance OAuth consent UI and scope handling

- Improved consent UI to reflect exact requested scopes and added better user guidance.
- Updated scope handling logic to ensure least-privilege access.
- Enhanced styling for better user experience and accessibility.

chore(docker): improve security and resource management in Docker setup

- Updated Docker Compose configuration to enforce read-only file systems and resource limits.
- Added health checks and logging options for better observability.
- Introduced optional Caddy reverse proxy for TLS termination.

fix(migrations): resolve ambiguity in create_company_with_owner function

- Dropped orphaned 3-arg overload of create_company_with_owner function.
- Recreated canonical 4-arg version with cash account seeding logic.
- Ensured proper permissions for function execution in Postgres.

* feat: enhance security checks for team membership in company creation

docker-compose.yml

@@ -1,18 +1,47 @@
 services:
   app:
-    image: ghcr.io/erp-mafia/gnubok:latest
+    image: ghcr.io/erp-mafia/gnubok:${IMAGE_TAG:-latest}
     env_file: .env
+    # Bound to loopback by default — put a TLS-terminating reverse proxy in
+    # front (see docker-compose.caddy.yml). Override PORT in .env to change
+    # the host port, or use the caddy overlay to remove the host binding.
     ports:
-      - "${PORT:-3000}:3000"
+      - "127.0.0.1:${PORT:-3000}:3000"
     security_opt:
       - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    init: true
+    # tmpfs ordering matters — the parent /app/.next must be mounted before
+    # any sub-mounts. The entrypoint cp's image-baked templates into these
+    # mounts at startup, then sed-substitutes, then chmod -R a-w.
+    #
+    # mode=750: root-owned, group-readable. The entrypoint runs as root long
+    # enough to copy templates, substitute placeholders, and chown the cache
+    # directory to nextjs:nodejs (gid 1001). nodejs group members can read
+    # the partially-substituted bundle during startup; nothing else on the
+    # host can. After chmod a-w the served files are read-only for everyone.
+    tmpfs:
+      - /tmp
+      - /app/.next:uid=0,gid=1001,mode=750,size=400m
+      - /app/public:uid=0,gid=1001,mode=750,size=200m
+    mem_limit: 1g
+    cpus: 2
+    pids_limit: 200
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/api/health"]
       interval: 30s
       timeout: 5s
-      start_period: 10s
+      start_period: 30s
+      start_interval: 5s
       retries: 3
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"
 
   cron:
     build:
@@ -27,4 +56,18 @@ services:
     volumes:
       - ./docker/crontab.self-hosted:/etc/supercronic/crontab:ro
     init: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp
+    mem_limit: 64m
+    pids_limit: 30
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"