3 commits

Author	SHA1	Message	Date
Claude	6e082ce58f	Stream D: Security hardening — 10 fixes from QA review ... - SEC-05: Fail fast if SECRET_KEY is default 'change-me-in-production' - SEC-06: CORS allow_credentials=False (Bearer tokens don't need it) - SEC-08: Input validation on auth schemas (min/max length, username pattern) - SEC-10: .dockerignore files (root, backend, mcp-connector) - SEC-11: Hardcode ALGORITHM='HS256' as constant, remove from settings - CQ-01: Gate crawl scheduler on CRAWL_ENABLED env var (default false) - OS-02: CONTRIBUTING.md - OS-03: CHANGELOG.md with v1.0.0 entry - setup.ps1: Add API_TOKEN generation (Windows parity with setup.sh)	2026-06-21 23:13:53 +00:00
Claude	69320e1e82	Fix all 7 launch blockers from security/QA review ... SEC-16: Add frontend ports mapping (80:80) to docker-compose.yml UI-01: Add routes for Welcome, SettingsIntegrations, MealPlan in App.jsx SEC-01: Remove traceback leak from auth error responses SEC-02: Fix require_admin to use is_admin column (was undefined ADMIN_USERNAME) SEC-03: Add API_TOKEN auth for MCP connector -> backend communication SEC-04: OAuth state now uses signed JWT tokens (was raw user UUID) OS-01: First registered user gets admin immediately during registration 10 files changed, 97 insertions(+), 25 deletions(-)	2026-06-16 01:50:09 +00:00
Claude	6fb5d759ef	Deliver Steps 3-8: integration config, meal plans, provider registry, MCP connector (14 tools), B2A files, nginx proxy, AGENT_GUIDE, LICENSE	2026-06-15 14:34:09 +00:00