Fix all 7 launch blockers from security/QA review

SEC-16: Add frontend ports mapping (80:80) to docker-compose.yml
UI-01:  Add routes for Welcome, SettingsIntegrations, MealPlan in App.jsx
SEC-01: Remove traceback leak from auth error responses
SEC-02: Fix require_admin to use is_admin column (was undefined ADMIN_USERNAME)
SEC-03: Add API_TOKEN auth for MCP connector -> backend communication
SEC-04: OAuth state now uses signed JWT tokens (was raw user UUID)
OS-01:  First registered user gets admin immediately during registration

10 files changed, 97 insertions(+), 25 deletions(-)

docker-compose.yml

@@ -2,6 +2,8 @@ services:
   frontend:
     build: ./frontend
     restart: unless-stopped
+    ports:
+      - "80:80"
     depends_on:
       backend:
         condition: service_healthy
@@ -18,6 +20,7 @@ services:
     env_file: .env
     environment:
       - BASE_URL=${BASE_URL:-http://localhost}
+      - API_TOKEN=${API_TOKEN:-}
     depends_on:
       fitness-db:
         condition: service_healthy
@@ -33,6 +36,7 @@ services:
     restart: unless-stopped
     environment:
       - FITNESS_API_URL=http://backend:8000
+      - API_TOKEN=${API_TOKEN:-}
     depends_on:
       backend:
         condition: service_healthy