feat(api): implement caching and logging in health check endpoint (#526)

* feat(api): implement caching and logging in health check endpoint

- Added in-memory caching for health check responses to reduce load on Postgres.
- Introduced logging for error handling in health check.
- Updated response structure to exclude error details from public responses.

feat(api): enhance OAuth consent UI and scope handling

- Improved consent UI to reflect exact requested scopes and added better user guidance.
- Updated scope handling logic to ensure least-privilege access.
- Enhanced styling for better user experience and accessibility.

chore(docker): improve security and resource management in Docker setup

- Updated Docker Compose configuration to enforce read-only file systems and resource limits.
- Added health checks and logging options for better observability.
- Introduced optional Caddy reverse proxy for TLS termination.

fix(migrations): resolve ambiguity in create_company_with_owner function

- Dropped orphaned 3-arg overload of create_company_with_owner function.
- Recreated canonical 4-arg version with cash account seeding logic.
- Ensured proper permissions for function execution in Postgres.

* feat: enhance security checks for team membership in company creation

docker-entrypoint.sh

@@ -27,27 +27,51 @@ if [ -n "$placeholders_found" ]; then
   printf "WARNING: These variables appear to contain placeholder values:\n%bPlease set them to real values before running in production.\n" "$placeholders_found" >&2
 fi
 
-# Replace build-time placeholder sentinels with runtime env vars in static JS bundles.
-# This allows a single pre-built image to work with any Supabase project.
-if [ -d /app/.next/static ]; then
-  find /app/.next -type f \( -name '*.js' -o -name '*.html' -o -name '*.rsc' -o -name '*.meta' -o -name '*.body' \) -exec sed -i \
-    -e "s|__NEXT_PUBLIC_SUPABASE_URL__|${NEXT_PUBLIC_SUPABASE_URL}|g" \
-    -e "s|__NEXT_PUBLIC_SUPABASE_ANON_KEY__|${NEXT_PUBLIC_SUPABASE_ANON_KEY}|g" \
-    -e "s|__NEXT_PUBLIC_APP_URL__|${NEXT_PUBLIC_APP_URL}|g" \
-    -e "s|__NEXT_PUBLIC_VAPID_PUBLIC_KEY__|${NEXT_PUBLIC_VAPID_PUBLIC_KEY:-}|g" \
-    -e "s|__NEXT_PUBLIC_SELF_HOSTED__|${NEXT_PUBLIC_SELF_HOSTED:-true}|g" \
-    -e "s|__NEXT_PUBLIC_REQUIRE_MFA__|${NEXT_PUBLIC_REQUIRE_MFA:-false}|g" \
-    -e "s|__NEXT_PUBLIC_BRANDING_APP_NAME__|${NEXT_PUBLIC_BRANDING_APP_NAME:-Gnubok}|g" \
-    {} +
+# Populate writable mount points from the baked-in templates. Under
+# docker-compose's read_only:true, /app/.next and /app/public are tmpfs
+# mounts; cp populates them in RAM. Without read_only:true the directories
+# were created empty in the Dockerfile, so cp still works.
+if [ -d /opt/gnubok-template/.next ]; then
+  cp -R /opt/gnubok-template/.next/. /app/.next/
 fi
+if [ -d /opt/gnubok-template/public ]; then
+  cp -R /opt/gnubok-template/public/. /app/public/
+fi
+
+# Ensure Next.js's runtime cache directory is writable by the unprivileged user.
+mkdir -p /app/.next/cache
+chown -R nextjs:nodejs /app/.next/cache
+chmod 755 /app/.next/cache
+
+# Substitute build-time placeholder sentinels with runtime env values.
+find /app/.next -type f \( -name '*.js' -o -name '*.html' -o -name '*.rsc' -o -name '*.meta' -o -name '*.body' \) -exec sed -i \
+  -e "s|__NEXT_PUBLIC_SUPABASE_URL__|${NEXT_PUBLIC_SUPABASE_URL}|g" \
+  -e "s|__NEXT_PUBLIC_SUPABASE_ANON_KEY__|${NEXT_PUBLIC_SUPABASE_ANON_KEY}|g" \
+  -e "s|__NEXT_PUBLIC_APP_URL__|${NEXT_PUBLIC_APP_URL}|g" \
+  -e "s|__NEXT_PUBLIC_VAPID_PUBLIC_KEY__|${NEXT_PUBLIC_VAPID_PUBLIC_KEY:-}|g" \
+  -e "s|__NEXT_PUBLIC_SELF_HOSTED__|${NEXT_PUBLIC_SELF_HOSTED:-true}|g" \
+  -e "s|__NEXT_PUBLIC_REQUIRE_MFA__|${NEXT_PUBLIC_REQUIRE_MFA:-false}|g" \
+  -e "s|__NEXT_PUBLIC_BRANDING_APP_NAME__|${NEXT_PUBLIC_BRANDING_APP_NAME:-Gnubok}|g" \
+  {} +
 
 # Stamp the service worker fallback notification title with the brand name.
 # public/sw.js is served as a static file (not bundled by Next), so NEXT_PUBLIC_*
-# inlining doesn't reach it — substitute the placeholder here at container start.
+# inlining doesn't reach it.
 if [ -f /app/public/sw.js ]; then
   sed -i \
     -e "s|__NEXT_PUBLIC_BRANDING_APP_NAME__|${NEXT_PUBLIC_BRANDING_APP_NAME:-Gnubok}|g" \
     /app/public/sw.js
 fi
 
-exec "$@"
+# Make the served JS bundle immutable. A runtime RCE in the Node process
+# cannot rewrite what other users will receive. Cache stays writable so
+# Next.js can populate its image-optimization / ISR caches.
+chmod -R a-w /app/.next/static
+[ -d /app/.next/server ] && chmod -R a-w /app/.next/server
+find /app/.next -maxdepth 1 -type f -exec chmod a-w {} +
+[ -f /app/public/sw.js ] && chmod a-w /app/public/sw.js
+
+# Drop privileges. The Node server runs as the unprivileged nextjs:nodejs user;
+# the now-immutable static dir is root-owned, so even a process compromise
+# inside Node cannot rewrite the served JS bundle.
+exec su-exec nextjs:nodejs "$@"