Harden security model and refresh UI to an editorial Obsidian Gallery theme

.env.example

@@ -1,12 +1,26 @@
-# Environment Variables
-# Copy this file to .env and fill in your values
+# =============================================================================
+# NextDrop — Environment Configuration
+# Copy this file to .env and fill in values.
+# =============================================================================
 
-# Server port (default: 3000)
+# Server port
 PORT=3000
 
-# JWT secret key — generate a random string for production
-# You can generate one with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
-JWT_SECRET=change-me-to-a-random-secret-key
+# Environment: "development" | "production"
+# In production, missing/placeholder JWT_SECRET will cause the server to exit.
+NODE_ENV=development
 
-# JWT token expiry (default: 24h)
+# JWT secret. REQUIRED in production. Generate one with:
+#   node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
+# In development, leave blank to auto-generate an ephemeral secret each boot.
+JWT_SECRET=
+
+# JWT token lifetime (e.g. "24h", "7d", "30m")
 JWT_EXPIRY=24h
+
+# CORS origins.
+#   • Leave blank for same-origin only (recommended for LAN deployments).
+#   • Set to "*" to allow any origin (legacy, insecure).
+#   • Or provide a comma-separated allowlist:
+#       CORS_ORIGINS=http://localhost:3000,http://192.168.1.10:3000
+CORS_ORIGINS=

package.json

@@ -1,18 +1,22 @@
 {
   "name": "nextdrop",
-  "version": "1.0.0",
-  "description": "Zero-storage LAN file transfer portal with real-time relay, chat, and encrypted transfers",
+  "version": "1.1.0",
+  "description": "Zero-storage LAN file transfer portal with real-time relay, chat, and authenticated WebSocket transfers",
   "main": "server/index.js",
   "type": "module",
   "scripts": {
     "start": "node server/index.js",
     "dev": "node --watch server/index.js"
   },
+  "engines": {
+    "node": ">=18"
+  },
   "keywords": ["file-transfer", "lan", "network", "socket.io", "real-time", "peer-to-peer"],
   "author": "isiliconx",
   "license": "MIT",
   "dependencies": {
     "bcryptjs": "^2.4.3",
+    "compression": "^1.7.4",
     "cors": "^2.8.5",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",