v0.9.0-rc: Security Review, API Stability & Upgrade Tests

[DeepZone]

Motivation

• Prepare the v0.9.0-rc release candidate by hardening default security posture (session cookies, password hashing, CORS), improving upgrade/migration visibility, and tightening UX consistency without introducing large new features.
• Ensure API stability and clear upgrade paths so self-hosted operators can safely migrate databases and verify migration state.
• Keep the product read-only toward external systems and preserve role-based access semantics while improving operational diagnostics and documentation.

Description

• Added configurable cookie parameters and system checks by introducing COOKIE_SAMESITE and using it for cookie set/delete operations, and expanded system-status security warnings for SameSite/COOKIE_SECURE and permissive CORS_ORIGINS settings.
• Strengthened password storage by switching new hashes to pbkdf2_sha256 (with 210_000 iterations) while retaining backward-compatible verification for legacy sha256 hashes.
• Prevent accidental production schema creation by gating Base.metadata.create_all() behind ALLOW_SQLITE_CREATE_ALL, and updated startup/version fields to 0.9.0 / v0.9.0-rc.
• Added a CI-friendly Alembic upgrade validation script at backend/scripts/check_upgrade_path.py to exercise alembic upgrade head, alembic current/heads and simulate a behind-revision scenario on a temporary SQLite DB.
• UX tweaks: removed browser prompt/confirm usages in key frontend flows (Users and Watch Mode) and replaced inline password-prompt UI with an explicit admin-driven note.
• Documentation and metadata updates: bumped backend/frontend package versions, updated README.md, RELEASE_NOTES.md, ROADMAP.md, and added upgrade/security guidance in docs/operations/*.md; updated one backend smoke test to expect the new system version.

Testing

• Ran backend unit/integration test suite with cd backend && pytest -q, which passed after aligning the tests to the new version string (final run: 102 passed).
• Built the frontend with cd frontend && npm run build, which completed successfully producing a production build.
• Added backend/scripts/check_upgrade_path.py as a CI/local check for upgrade paths (script included but not executed as part of the automated test suite here).

---

Codex Task