fix(newman): resolve API integration test failures — auth header, negative test body, and issues assertion

.bandit

@@ -0,0 +1,5 @@
+[bandit]
+# Bandit SAST configuration
+# Suppress known false-positives in this project
+
+skips = B104  # binding to 0.0.0.0 is intentional for containerized deployments

.dockerignore

@@ -0,0 +1,65 @@
+# Docker ignore — prevents sensitive/unnecessary files from entering the image
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Python artifacts
+__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+.Python
+*.egg
+*.egg-info/
+dist/
+build/
+.eggs/
+
+# Virtual environment
+venv/
+env/
+.venv/
+.env/
+
+# Environment files — secrets must NOT be baked into the image
+.env
+.env.*
+*.env
+
+# Git
+.git/
+.gitignore
+.gitattributes
+
+# Tests & CI (not needed in runtime image)
+tests/
+.pytest_cache/
+.coverage
+coverage.xml
+htmlcov/
+.bandit
+codecov.yml
+
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+Thumbs.db
+
+# Documentation
+*.md
+docs/
+
+# CI/CD config
+.github/
+Makefile
+
+# Terraform / IaC
+terraform/
+*.tfstate
+*.tfstate.backup
+.terraform/
+
+# Postman
+*.postman_collection.json

.env.example

@@ -0,0 +1,23 @@
+# ============================================================
+# .env.example — Chart Validation System
+# Copy this to .env and fill in real values.
+# NEVER commit the real .env file to version control.
+# ============================================================
+
+# Application
+APP_VERSION=2.0.0
+DEBUG=false
+LOG_LEVEL=INFO
+
+# Security — CHANGE THIS before any deployment
+SECRET_KEY=replace-this-with-a-strong-random-secret
+
+# CORS — restrict in production (comma-separated origins)
+# CORS_ORIGINS=["https://yourdomain.com"]
+
+# Server
+HOST=0.0.0.0
+PORT=8000
+
+# Validation
+VALID_SCORE_THRESHOLD=70