chore(prod): Sprint 6 — production readiness & deployment hardening

[tedtadesse]

Configuration / infrastructure / docs only. No business logic, GraphQL schema, or model changes — Flutter compatibility fully preserved.

Highlights

• Config + fail-fast (1/4): DEBUG/ALLOWED_HOSTS/SECRET_KEY/DB/email env-driven with safe defaults; Postgres via DATABASE_URL; WhiteNoise static; startup validation refuses to boot in prod when secrets/hosts/JWT/email/DB/cache are missing (skipped for tests).
• Security headers (2/3): HSTS, X-Frame-Options: DENY, nosniff, Referrer-Policy, Permissions-Policy, secure/HttpOnly/SameSite cookies, SSL redirect (prod-gated). CORS allow-all removed → explicit env allow-list; CSRF trusted origins from env.
• Logging (5): structured stdout, separate app/security loggers, rotation-friendly.
• Ops (6): /health/, /live/, /ready/ (DB + cache), /version/.
• Deployment (7): multi-stage non-root Dockerfile, docker-compose (web+postgres+redis), gunicorn.conf.py, entrypoint.sh, .env.example, .dockerignore, requirements.txt/-dev.txt (dependency pinning — none existed).
• Backup (8): scripts/backup_db.sh, restore_db.sh, backup_media.sh.
• CI (9): GitHub Actions — ruff, migration check, system + check --deploy, tests+coverage, bandit, pip-audit, docker build.
• Docs (10): docs/DEPLOYMENT.md, PRODUCTION_CHECKLIST.md, BACKUP_RESTORE.md.
• Hygiene: added .gitignore; untracked committed .env (secrets), db.sqlite3, and all __pycache__/*.pyc.

Notes

• Not executed here (no Python runtime in the work env); all .py files py_compile-clean. CI will run the real gates. The most likely first CI catch is makemigrations --check (verifies the hand-written constraint/index migrations match models).
• Rotate the previously committed Gmail app-password + old SECRET_KEY — they remain in git history (documented in PRODUCTION_CHECKLIST.md).
• Dev setup is now cp .env.example .env (sets DJANGO_DEBUG=True).

🤖 Generated with Claude Code