v0.5.4-beta: Production polish & security baseline

[DeepZone]

Motivation

• Improve self-hosting security and production readiness without adding new routing or write features.
• Harden container runtime practices (avoid root where practical) and reduce secrets/artefacts in images.
• Provide a conservative set of HTTP security headers, clearer CORS guidance, operations docs and a release checklist for safe deployments.

Description

• Hardened backend image by adding a non-root routeforge user, adjusting ownership of /app and ensuring runtime files are created during build in backend/Dockerfile.
• Added baseline security headers (including conservative Content-Security-Policy) and ensured proxy headers for /api/ and /health in frontend/nginx.conf, while keeping the SPA-compatible CSP (style-src 'unsafe-inline' allowed initially).
• Introduced a logging baseline using LOG_LEVEL from settings and a startup log that records version, mode, database type and RIPEstat parameters in backend/app/main.py and added log_level/postgres_password settings in backend/app/config.py.
• Added an optional default-password detection that surfaces `

---

Codex Task