fix(public): establish a safe a0p release boundary

[erinepshovel-code]

Outcome

Creates a bounded public-release candidate for a0p without treating the broken historical Replit runtime as source authority.

Runtime and deployment

• builds one production image with Node/Express and Python/Uvicorn
• passes the required internal API and admin secrets to Cloud Run
• removes the invalid legacy cloudbuild.yaml; GitHub Actions is canonical
• adds PR-time production-container builds plus PostgreSQL-backed tests
• makes the intended public origin explicit for Stripe and canonical metadata

Public boundary

• durable login, registration, and authenticated model-start rate limits
• atomic guest budget reservation before paid provider calls
• free-provider allowlist and a two-lane cap for chat and Fleet
• premium provider tiers for the most expensive models
• tool tiers enforced both in model-visible schemas and at dispatch
• privileged/shared-state/account-backed/high-cost tools closed to public users
• CLI restricted to working-set/operator accounts
• bounded request bodies, safer public errors, security headers, a Stripe-aware CSP, and minimal auth-user projection
• owner-scoped custom-tool reads
• chat attachments hidden/disabled in production until shared durable storage is explicitly enabled

Source privacy

• removes runtime uploads and unreferenced attached assets from the current tree
• excludes both from future source control and container contexts
• adds an explicit release gate documenting that Git history still requires a deliberate purge and credential review before launch

Evidence

Latest head 7cfe3dee8d066c9be294e6aa17f0974a0b32f404 passes:

• Clean Build Check
• production Docker image build
• PostgreSQL-backed distributed rate-limit concurrency check
• full Python suite and console-tab regression guard
• provider/public-policy contracts
• local TypeScript check and production build
• npm audit --omit=dev: 0 vulnerabilities

The original CodeQL finding is now localized: the first PR commit disabled Helmet contentSecurityPolicy in server/index.ts. Commit 4cd3bf230c4ce14645a37ac5573123f4a86afb39 replaced that with the current Stripe-aware CSP, and GitHub marks the original review thread resolved/outdated. However, the completed exact-head CodeQL summary for 7cfe3dee8d066c9be294e6aa17f0974a0b32f404 still reports 1 new medium-severity alert. Treat the security gate as inconsistent, not clean, until a fresh current-head analysis reports zero new alerts.

Do not release yet

Keep this PR in draft until:

1. a fresh current-head CodeQL analysis reports zero new alerts; the original Helmet CSP defect is source-repaired, but the current summary has not supplied a clean acceptance witness;
2. historical runtime data is purged from Git history and credential review/rotation is complete;
3. Cloud Run, PostgreSQL, Secret Manager, and the deployment opt-in are configured;
4. staging smoke tests pass;
5. system-primary memory and cross-owner features remain unexposed until the privacy/consent/audit contracts in PUBLIC_RELEASE.md are implemented.

The current public hostname is not treated as a live deployment.

hmmm: GitHub marks the original CodeQL thread resolved/outdated while the latest exact-head CodeQL summary still reports one medium alert. Do not merge or release until a fresh scan settles that contradiction.