feat: v3.0.0 — production-grade DevSecOps upgrade

[nageshbhagelli]

BREAKING CHANGES:

• API key authentication now required on /validate-chart, /validate-chart/batch, /history
• Server hard-exits on startup if default SECRET_KEY or API_KEY used in production (DEBUG=false)

Security:

• SecretStr for SECRET_KEY and API_KEY (values never appear in logs/repr)
• secrets.compare_digest for timing-attack-safe key comparison
• Input sanitisation: max_length on all strings, max_items on all lists (→ 422)
• Rate limiting: 30 req/min (single), 10 req/min (batch) via slowapi

Persistence:

• SQLAlchemy 2.0 async engine with aiosqlite
• ValidationHistory ORM model — every validation result persisted
• /metrics now reads from DB (survives server restarts)
• /history endpoint: paginated, filterable by status + chart_type

CI/CD fixes:

• Fixed startup guard blocking test/newman jobs (added DEBUG=true, API_KEY_ENABLED=false)
• Fixed smoke test missing X-API-Key header (auth now enforced)
• Fixed Bandit --exit-zero negating HIGH severity check
• Fixed trivy-action tag: 0.20.0 → v0.36.0 (v prefix required, bumped to latest)
• Fixed publish job if-condition with !failure() && !cancelled() guard
• Added security-events: write permission to trivy-scan job

Testing:

• 36 tests (was 24) — 86% coverage — 0 warnings
• conftest.py: in-memory SQLite override, session-scoped TestClient fixture
• New tests: auth 401/403, input sanitisation 422, /history pagination/filters, metrics DB persistence, X-Correlation-ID echo, X-Response-Time header

New files:

• app/core/database.py — async SQLAlchemy engine + session + init_db()
• app/core/security.py — X-API-Key FastAPI dependency
• app/models/db_models.py — ValidationHistory ORM model
• tests/conftest.py — in-memory DB + TestClient fixture
• pytest.ini — asyncio_mode=auto, silences pytest-asyncio warning
• frontend/index.html — dark dashboard with animated gauge + Chart.js
• Dockerfile — multi-stage, non-root user, HEALTHCHECK
• docker-compose.yml — local stack with healthchecks
• Makefile — dev/test/build/trivy/compose-up targets
• .bandit / .env.example / .dockerignore

README: full rewrite with architecture diagram, pipeline flow, curl examples